Cryptomator vulnerabilities
We track 4 vulnerabilities in Cryptomator products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 20, 2026.
Latest Cryptomator vulnerabilities
- 7.5 High severity
cryptomator: Cleartext Transmission of Sensitive Information
Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, the Hub-based unlock flow explicitly supports hub+http and consumes Hub endpoints from vault metadata without enforcing HTTPS. As a result, a vault configuration can drive
- 7.8 High severity
cryptomator: Improper Privilege Management
Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair fun
- 7.8 High severity
cryptomator: Improper Privilege Management
Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs
- 7.8 High severity
Cryptomator: Untrusted Search Path
Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can