PT-2026-26658 · Cryptomator · Cryptomator

Yanchon918S · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-32310

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cryptomator versions 1.6.0 through 1.19.0

Description Cryptomator encrypts data stored in cloud infrastructure. Versions prior to 1.19.1 parse vault configuration before verifying its integrity. The masterkeyfile loader utilizes the unverified key ID as a filesystem path, resolving keyId.getSchemeSpecificPart() against the vault path and checking for file existence using Files.exists(). This allows a malicious vault configuration to leverage parent directory escapes, absolute local paths, or UNC paths (e.g., masterkeyfile://attacker/share/masterkey.cryptomator). Specifically on Windows, the UNC variant can trigger outbound SMB access before passphrase entry due to path resolution. The vulnerable function is Files.exists(). The vulnerable parameter is keyId.

Recommendations Update to version 1.19.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32310

GHSA-5PHC-5PFX-HR52

Affected Products

Cryptomator

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32310.json · Exploit
• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-5phc-5pfx-hr52 · Vendor Advisory
• https://github.com/cryptomator/cryptomator/commit/1e3dfe3de1623b1b85d24db91e49d31d1ea11f40 · Patch
• https://osv.dev/vulnerability/CVE-2026-32310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32310 · Security Note
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.1 · Note
• https://github.com/cryptomator/cryptomator/pull/4180 · Note
• https://twitter.com/CVEnew/status/2035619779797757998 · Twitter Post