What is the CVSS score of CVE-2026-32310?

CVE-2026-32310 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-32310?

CVE-2026-32310 presents moderate security risk, a path traversal vulnerability rated CVSS 4.1. This could allow unauthorized file access.

How to fix or mitigate CVE-2026-32310?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Windows CVE-2026-32310

EUVD-2026-13750 MEDIUM

Path Traversal (CWE-22)

2026-03-20 GitHub_M

Hashicorp Microsoft Path Traversal Windows

4.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.1 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 18:30 euvd

EUVD-2026-13750

Analysis Generated

Mar 20, 2026 - 18:30 vuln.today

CVE Published

Mar 20, 2026 - 18:19 nvd

MEDIUM 4.1

DescriptionGitHub Advisory

Cryptomator encrypts data being stored on cloud infrastructure. From version 1.6.0 to before version 1.19.1, vault configuration is parsed before its integrity is verified, and the masterkeyfile loader uses the unverified keyId as a filesystem path. The loader resolves keyId.getSchemeSpecificPart() directly against the vault path and immediately calls Files.exists(...). This allows a malicious vault config to supply parent-directory escapes, absolute local paths, or UNC paths (e.g., masterkeyfile://attacker/share/masterkey.cryptomator). On Windows, the UNC variant is especially dangerous because Path.resolve("//attacker/share/...") becomes \\attacker\share\..., so the existence check can trigger outbound SMB access before the user even enters a passphrase. This issue has been patched in version 1.19.1.

AnalysisAI

Cryptomator versions 1.6.0 through 1.19.0 contain a path traversal vulnerability in vault configuration parsing where the masterkeyfile loader resolves an unverified keyId parameter as a filesystem path before integrity checks are performed. An attacker with the ability to supply a malicious vault configuration can exploit this to trigger arbitrary file existence checks, including UNC paths on Windows that can initiate outbound SMB connections before the user even enters a passphrase, potentially leading to information disclosure about local file structure and network exposure. The vulnerability has been patched in version 1.19.1, and while no active KEV exploitation has been reported, the low attack complexity and the ability to chain this with social engineering (malicious vault sharing) makes it a moderate practical risk.

Technical ContextAI

Cryptomator is a client-side encryption application for securing files on cloud storage platforms. The vulnerability exists in the vault configuration loader component, which is responsible for parsing and validating vault metadata before decryption operations. The root cause is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, aka Path Traversal), where the application resolves user-controlled input (keyId from vault config) directly using Path.resolve() against the vault directory without prior validation or sanitization. The masterkeyfile URI scheme handler extracts keyId.getSchemeSpecificPart() and immediately calls Files.exists() to verify the key file, but this check occurs before the vault configuration integrity is cryptographically verified. On Windows systems specifically, UNC path syntax (//attacker/share/) is converted to SMB network paths (\\attacker\share\), allowing attackers to trigger SMB connection attempts that can be intercepted or logged by network monitoring tools. The affected CPE is cpe:2.3:a:cryptomator:cryptomator:*:*:*:*:*:*:*:*

RemediationAI

Upgrade Cryptomator immediately to version 1.19.1 or later, which includes the fix implemented in commit 1e3dfe3de1623b1b85d24db91e49d31d1ea11f40 (see https://github.com/cryptomator/cryptomator/pull/4180 for the merge details). Users unable to patch immediately should avoid opening vault configuration files from untrusted sources and be cautious when sharing vault files with others, particularly on Windows systems where UNC path exploitation could expose network topology. Network administrators may consider implementing SMB egress filtering on Windows workstations to prevent unexpected outbound SMB connections that could be triggered by malicious vault configurations. Until patching is completed, treat all vault files as potentially malicious and restrict access to trusted, in-house generated vaults only.