PT-2026-26658 · Cryptomator · Cryptomator

Yanchon918S · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-32310

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cryptomator versions 1.6.0 through 1.19.0

Description Cryptomator encrypts data stored in cloud infrastructure. Versions prior to 1.19.1 parse vault configuration before verifying its integrity. The masterkeyfile loader utilizes the unverified key ID as a filesystem path, resolving keyId.getSchemeSpecificPart() against the vault path and checking for file existence using Files.exists(). This allows a malicious vault configuration to leverage parent directory escapes, absolute local paths, or UNC paths (e.g., masterkeyfile://attacker/share/masterkey.cryptomator). Specifically on Windows, the UNC variant can trigger outbound SMB access before passphrase entry due to path resolution. The vulnerable function is Files.exists(). The vulnerable parameter is keyId.

Recommendations Update to version 1.19.1 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-32310

GHSA-5PHC-5PFX-HR52

Produtos afetados

Cryptomator

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32310.json · Exploit
• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-5phc-5pfx-hr52 · Aviso do Fabricante
• https://github.com/cryptomator/cryptomator/commit/1e3dfe3de1623b1b85d24db91e49d31d1ea11f40 · Correção
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.1 · Nota
• https://github.com/cryptomator/cryptomator/pull/4180 · Nota
• https://twitter.com/CVEnew/status/2035619779797757998 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32310 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32310 · Nota de Segurança