High severity7.0NVD Advisory· Published Jul 25, 2023· Updated Jun 17, 2026
CVE-2023-37907
CVE-2023-37907
Description
Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:cryptomator:cryptomator:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:cryptomator:cryptomator:*:*:*:*:*:*:*:*range: <1.9.2
- (no CPE)range: <1.9.2
- (no CPE)range: 1.9.2
Patches
Vulnerability mechanics
References
3- github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670b868fa208cnvdPatch
- github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjqnvdExploitIssue TrackingVendor Advisory
- github.com/cryptomator/cryptomator/releases/tag/1.9.2nvdRelease Notes
News mentions
0No linked articles in our index yet.