Cryptomator

10 CVEs across 3 Cryptomator products. Browse Cryptomator vulnerabilities, severities, and proof-of-concept exploits.

Cryptomator products with known CVEs

ProductCVEs
Cryptomator10
Android1
iOS1
Cryptomator CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-33472Medium4.82026-04-16Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw in CheckHostTrustController.getAuthori…
CVE-2026-32318High7.62026-03-20Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability a…
CVE-2026-32317High7.62026-03-20Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerabil…
CVE-2026-32310Medium4.12026-03-20Cryptomator encrypts data being stored on cloud infrastructure. From version 1.6.0 to before version 1.19.1, vault configuration is parsed before its integrity…
CVE-2026-32309High7.52026-03-20Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, the Hub-based unlock flow explicitly supports hub+http and consumes Hu…
CVE-2026-32303High7.62026-03-20Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the…
CVE-2026-29110Low2.22026-03-06Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths into the log…
CVE-2023-39520Medium5.52023-08-07Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege…
CVE-2023-37907High7.02023-07-25Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows…
CVE-2022-25366High7.82022-02-19Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-librar…