CVE-2026-29110: 
NixOS vulnerability analysis and mitigation

CVE-2026-29110 is an information disclosure vulnerability in Cryptomator, an open-source encryption tool for cloud storage, where cleartext file paths may be leaked into log files during non-debug mode operation. All versions prior to 1.19.0 are affected. The vulnerability was published on March 6, 2026, and patched in version 1.19.0. It carries a CVSS v3.1 base score of 2.2 (Low) per the GitHub Security Advisory, though an alternate NVD score of 5.3 (Medium) has also been assigned (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). When a filesystem request fails — for example, due to a damaged encrypted file or a reference to a non-existent file — Cryptomator generates a log message that inadvertently includes the cleartext (decrypted) path of the file involved, even when the vault is closed and the application is not in debug mode. This means the sensitive path metadata is persisted to disk in log files without the protection of the vault's encryption. The vulnerability does not expose file contents, only path metadata, and only occurs under error conditions rather than during normal operation (GitHub Advisory).

Successful exploitation results in a limited confidentiality impact: an attacker who gains access to Cryptomator log files can infer metadata about the structure and contents of an encrypted vault — such as file and directory names — even when the vault itself is locked. There is no impact on integrity or availability, and file contents are not exposed. The risk is primarily relevant to scenarios where log files are accessible to unauthorized local users or are inadvertently shared, potentially revealing sensitive organizational or personal file naming conventions (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability requires local access with limited privileges and user interaction (e.g., a failed filesystem operation must occur), making opportunistic exploitation unlikely. It is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Gain local access: Obtain local access to a system running Cryptomator prior to version 1.19.0, with at least limited user privileges.
2. Trigger filesystem errors: Cause filesystem request failures against a Cryptomator vault — for example, by referencing a damaged encrypted file or a non-existent file path — which prompts Cryptomator to generate error log entries containing cleartext paths.
3. Locate log files: Navigate to the platform-specific log directory to find Cryptomator log files (.log extension):
   • Windows: %LOCALAPPDATA%/Cryptomator
   • macOS: ~/Library/Logs/Cryptomator
   • Linux: ~/.local/share/Cryptomator/logs
4. Extract cleartext paths: Open or parse the log files to identify logged cleartext file paths, revealing vault structure and file naming metadata even while the vault is closed (GitHub Advisory).

• File System: Presence of Cryptomator log files (.log) in platform-specific directories (%LOCALAPPDATA%/Cryptomator on Windows, ~/Library/Logs/Cryptomator on macOS, ~/.local/share/Cryptomator/logs on Linux) containing cleartext file path strings that correspond to vault contents.
• Logs: Log entries in Cryptomator .log files that include human-readable file or directory paths (rather than encrypted ciphertext names), particularly associated with error messages about failed filesystem operations such as missing or damaged files.

Upgrade Cryptomator to version 1.19.0 or later, which resolves the cleartext path logging issue. As an immediate workaround for users unable to upgrade, delete existing application log files (those ending in .log) from the following locations: Windows: %LOCALAPPDATA%/Cryptomator; macOS: ~/Library/Logs/Cryptomator; Linux: ~/.local/share/Cryptomator/logs. Additionally, restrict filesystem permissions on log directories to prevent unauthorized users from reading log files. Audit previously generated logs for any sensitive path information that may have been inadvertently recorded (GitHub Advisory).

The vulnerability was assigned a Low severity rating by the Cryptomator project itself (CVSS 2.2), reflecting its limited exploitability and impact scope. Coverage has been limited to automated vulnerability tracking platforms and aggregators. No notable researcher commentary or significant media coverage has been identified beyond standard CVE publication channels (GitHub Advisory).