{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29110", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T21:54:06.709Z", "datePublished": "2026-03-06T17:53:53.948Z", "dateUpdated": "2026-03-06T18:33:33.603Z"}, "containers": {"cna": {"title": "Cryptomator: Leaking of cleartext paths into log file in non-debug mode", "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "lang": "en", "description": "CWE-209: Generation of Error Message Containing Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw"}], "affected": [{"vendor": "cryptomator", "product": "cryptomator", "versions": [{"version": "< 1.19.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T17:53:53.948Z"}, "descriptions": [{"lang": "en", "value": "Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log file. This can reveal meta information about the files stored inside a vault at a time, where the actual vault is closed. Not every cleartext path is logged. Only if a filesystem request fails for some reason (e.g. damaged encrypted file, not existing file), a log message is created. This issue has been patched in version 1.19.0."}], "source": {"advisory": "GHSA-j83j-mwhc-rcgw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T18:33:27.216732Z", "id": "CVE-2026-29110", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:33:33.603Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T18:33:27.216732Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:33:29.906Z"}}], "cna": {"title": "Cryptomator: Leaking of cleartext paths into log file in non-debug mode", "source": {"advisory": "GHSA-j83j-mwhc-rcgw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "cryptomator", "product": "cryptomator", "versions": [{"status": "affected", "version": "< 1.19.0"}]}], "references": [{"url": "https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw", "name": "https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log file. This can reveal meta information about the files stored inside a vault at a time, where the actual vault is closed. Not every cleartext path is logged. Only if a filesystem request fails for some reason (e.g. damaged encrypted file, not existing file), a log message is created. This issue has been patched in version 1.19.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209: Generation of Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T17:53:53.948Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29110", "state": "PUBLISHED", "dateUpdated": "2026-03-06T18:33:33.603Z", "dateReserved": "2026-03-03T21:54:06.709Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T17:53:53.948Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cryptomator:cryptomator:*:*:*:*:*:*:*:*", "matchCriteriaId": "09E2423D-951D-4A0F-9291-C2F075533707", "versionEndExcluding": "1.19.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log file. This can reveal meta information about the files stored inside a vault at a time, where the actual vault is closed. Not every cleartext path is logged. Only if a filesystem request fails for some reason (e.g. damaged encrypted file, not existing file), a log message is created. This issue has been patched in version 1.19.0."}, {"lang": "es", "value": "Cryptomator cifra los datos que se almacenan en infraestructura en la nube. Antes de la versi\u00f3n 1.19.0, en modo no depuraci\u00f3n, Cryptomator podr\u00eda filtrar rutas en texto claro en el archivo de registro. Esto puede revelar metadatos sobre los archivos almacenados dentro de una b\u00f3veda, incluso cuando la b\u00f3veda real est\u00e1 cerrada. No todas las rutas en texto claro se registran. Solo si una solicitud del sistema de archivos falla por alguna raz\u00f3n (p. ej., archivo cifrado da\u00f1ado, archivo inexistente), se genera un mensaje de registro. Este problema ha sido parcheado en la versi\u00f3n 1.19.0."}], "id": "CVE-2026-29110", "lastModified": "2026-03-13T18:58:03.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-06T18:16:20.453", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cryptomator", "source": "cna", "vendor": "cryptomator"}, "product": "cryptomator", "vendor": "cryptomator"}], "analysis": {"en": {"generated_at": "2026-04-16T11:16:07.998303+00:00", "value": {"mitigation_remediation": ["Upgrade Cryptomator to version 1.19.0 or later, which removes the logging of cleartext paths.", "Configure file system permissions so that the log file directory is accessible only to trusted users, preventing unauthorized read access.", "Reduce logging of filesystem failures, if the application provides an option, so that paths are no longer recorded; otherwise, ensure the logs are aggressively rotated and purged to limit the window of exposure."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Cryptomator application distributed by the Cryptomator team. All releases before version 1.19.0 are impacted. Users deploying these earlier versions should identify the exact version installed and consider an upgrade.", "description_and_impact": "Prior to version 1.19.0, Cryptomator may write cleartext file paths to its log file whenever a file system request fails, such as when an encrypted file is damaged or missing. This behavior leaks metadata about the contents stored in a vault at a time when the vault is closed, potentially revealing which files exist or were accessed. The flaw does not expose the encrypted data itself or allow execution of code; it is a confidentiality issue classified as CWE\u2011209.", "risk_and_exploitability": "The CVSS score of 2.2 indicates a low-risk severity, and the EPSS score of less than 1 percent reflects a very low probability of exploitation. Because the log files are stored locally, an attacker would need local or remote access to the machine\u2019s file system to read them, implying that the attack vector is most likely local. The vulnerability is not listed in the CISA KEV catalog, further underscoring its limited risk profile at this time, but it can still aid adversaries in fingerprinting the contents of a vault."}}}}, "created": "2026-03-09T10:07:11.353441+00:00", "updated": "2026-04-16T11:30:15.893220+00:00", "vendors": ["cryptomator", "cryptomator$PRODUCT$cryptomator"]}