CVE-2026-32310

Cryptomator encrypts data being stored on cloud infrastructure. From version 1.6.0 to before version 1.19.1, vault configuration is parsed before its integrity is verified, and the masterkeyfile loader uses the unverified keyId as a filesystem path. The loader resolves keyId.getSchemeSpecificPart() directly against the vault path and immediately calls Files.exists(...). This allows a malicious vault config to supply parent-directory escapes, absolute local paths, or UNC paths (e.g., masterkeyfile://attacker/share/masterkey.cryptomator). On Windows, the UNC variant is especially dangerous because Path.resolve("//attacker/share/...") becomes \\attacker\share\..., so the existence check can trigger outbound SMB access before the user even enters a passphrase. This issue has been patched in version 1.19.1.

• CWE-22

• https://github.com/cryptomator/cryptomator/commit/1e3dfe3de1623b1b85d24db91e49d31d1ea11f40Patch
• https://github.com/cryptomator/cryptomator/pull/4180Issue Tracking
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.1Release Notes
• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-5phc-5pfx-hr52Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32304Locutus brings stdlibs of other programming languages to Jav…9.8
• CVE-2026-32305Traefik is an HTTP reverse proxy and load balancer. Versions…5.3
• CVE-2026-32306OneUptime is a solution for monitoring and managing online s…9.9
• CVE-2026-32308OneUptime is a solution for monitoring and managing online s…7.6
• CVE-2026-32309Cryptomator encrypts data being stored on cloud infrastructu…7.5
• CVE-2026-3231The Checkout Field Editor (Checkout Manager) for WooCommerce…7.2
• CVE-2026-32311Flowsint is an open-source OSINT graph exploration tool desi…9.8
• CVE-2026-32312GLPI is a free asset and IT management software package. In …4.3
• CVE-2026-32313xmlseclibs is a library written in PHP for working with XML …8.2
• CVE-2026-32314Yamux is a stream multiplexer over reliable, ordered connect…7.5
• CVE-2026-32315motionEye (mEye) is an online interface for motion software,…5.5
• CVE-2026-32316jq is a command-line JSON processor. An integer overflow vul…7.5