Prior to version 1.19.0, Cryptomator may write cleartext file paths to its log file whenever a file system request fails, such as when an encrypted file is damaged or missing. This behavior leaks metadata about the contents stored in a vault at a time when the vault is closed, potentially revealing which files exist or were accessed. The flaw does not expose the encrypted data itself or allow execution of code; it is a confidentiality issue classified as CWE‑209.

The vulnerability affects the Cryptomator application distributed by the Cryptomator team. All releases before version 1.19.0 are impacted. Users deploying these earlier versions should identify the exact version installed and consider an upgrade.

The CVSS score of 2.2 indicates a low-risk severity, and the EPSS score of less than 1 percent reflects a very low probability of exploitation. Because the log files are stored locally, an attacker would need local or remote access to the machine’s file system to read them, implying that the attack vector is most likely local. The vulnerability is not listed in the CISA KEV catalog, further underscoring its limited risk profile at this time, but it can still aid adversaries in fingerprinting the contents of a vault.