PT-2026-23736 · Cryptomator · Cryptomator

Infe0 · Published 2026-03-06 · Updated 2026-03-06 · CVE-2026-29110

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cryptomator versions prior to 1.19.0

Description Cryptomator encrypts data stored on cloud infrastructure. Before version 1.19.0, in non-debug mode, Cryptomator could log cleartext file paths. This could reveal metadata about files within a vault when the vault is closed. Cleartext paths are only logged if a filesystem request fails, such as when an encrypted file is damaged or does not exist.

Recommendations Update to version 1.19.0 or later.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-29110

GHSA-J83J-MWHC-RCGW

Affected Products

Cryptomator

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29110.json · Exploit
• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29110 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29110 · Vendor Advisory
• https://t.me/CVEtracker/46635 · Telegram Post