CVE-2026-29110 Cryptomator: Leaking of cleartext paths into log file in non-debug mode

Low 2.2 Published 6 Mar 2026 Updated 6 Mar 2026

An attacker with log file access can view cleartext file paths from failed operations, revealing metadata about encrypted vault contents.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-29110?

CVE-2026-29110 is a low-severity vulnerability in cryptomator, published on 6 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log file. This can reveal meta information about the files stored inside a vault at a time, where the actual vault is closed. Not every cleartext path is logged. Only if a filesystem request fails for some reason (e.g. damaged encrypted file, not existing file), a log message is created. This issue has been patched in version 1.19.0.

Weakness: CWE-209

Which versions are affected by CVE-2026-29110?

It affects 1 product.

Products include Cryptomator Cryptomator.

How do I fix CVE-2026-29110?

No fix has been published for CVE-2026-29110 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-29110 being exploited?

There is no known exploitation of CVE-2026-29110 in the wild and no public exploit code.

Sources

Also known as GHSA-j83j-mwhc-rcgw.