CVE-2026-29110

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log file. This can reveal meta information about the files stored inside a vault at a time, where the actual vault is closed. Not every cleartext path is logged. Only if a filesystem request fails for some reason (e.g. damaged encrypted file, not existing file), a log message is created. This issue has been patched in version 1.19.0.

CVSS v3 2.2 LOW

2.2^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cryptomator:cryptomator:*:*:*:*:*:*:*:*

History

13 Mar 2026, 18:58

Type	Values Removed	Values Added
Summary		(es) Cryptomator cifra los datos que se almacenan en infraestructura en la nube. Antes de la versión 1.19.0, en modo no depuración, Cryptomator podría filtrar rutas en texto claro en el archivo de registro. Esto puede revelar metadatos sobre los archivos almacenados dentro de una bóveda, incluso cuando la bóveda real está cerrada. No todas las rutas en texto claro se registran. Solo si una solicitud del sistema de archivos falla por alguna razón (p. ej., archivo cifrado dañado, archivo inexistente), se genera un mensaje de registro. Este problema ha sido parcheado en la versión 1.19.0.
CPE		cpe:2.3:a:cryptomator:cryptomator::::::::
First Time		Cryptomator cryptomator Cryptomator
References	~~() https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw -~~	() https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw - Mitigation, Vendor Advisory

06 Mar 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-06 18:16

Updated : 2026-03-13 18:58

NVD link : CVE-2026-29110

Mitre link : CVE-2026-29110

CVE.ORG link : CVE-2026-29110

JSON object : View

Products Affected

cryptomator

cryptomator

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2026-29110", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-03-06T18:16:20.453", "references": [{"url": "https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log file. This can reveal meta information about the files stored inside a vault at a time, where the actual vault is closed. Not every cleartext path is logged. Only if a filesystem request fails for some reason (e.g. damaged encrypted file, not existing file), a log message is created. This issue has been patched in version 1.19.0."}, {"lang": "es", "value": "Cryptomator cifra los datos que se almacenan en infraestructura en la nube. Antes de la versi\u00f3n 1.19.0, en modo no depuraci\u00f3n, Cryptomator podr\u00eda filtrar rutas en texto claro en el archivo de registro. Esto puede revelar metadatos sobre los archivos almacenados dentro de una b\u00f3veda, incluso cuando la b\u00f3veda real est\u00e1 cerrada. No todas las rutas en texto claro se registran. Solo si una solicitud del sistema de archivos falla por alguna raz\u00f3n (p. ej., archivo cifrado da\u00f1ado, archivo inexistente), se genera un mensaje de registro. Este problema ha sido parcheado en la versi\u00f3n 1.19.0."}], "lastModified": "2026-03-13T18:58:03.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cryptomator:cryptomator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09E2423D-951D-4A0F-9291-C2F075533707", "versionEndExcluding": "1.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}