Cybersecurity researchers from ETH Zurich uncovered significant cryptographic vulnerabilities in several major end-to-end encrypted (E2EE) cloud storage platforms, including Sync, pCloud, Icedrive, Seafile, and Tresorit, collectively used by over 22 million people. These flaws allow attackers to inject, tamper with, or access user data by exploiting a compromised server. The vulnerabilities include unauthenticated key material, encryption protocol downgrades, and metadata manipulation, which compromise file confidentiality, integrity, and user security. Specific weaknesses, such as Sync’s exposure of shared passwords and key injection issues, pCloud’s encryption tampering, and Icedrive’s unauthenticated CBC encryption, make these systems vulnerable to attackers, including nation-state actors and skilled hackers. Despite these concerns, Tresorit fared relatively better, with issues confined to metadata and public key handling, though improvements are planned for 2025. While Icedrive declined to address the identified flaws, other providers have begun responding, with some issues already patched. This research underscores the gap between the security claims of E2EE platforms and the real-world risks they face, highlighting the need for stronger cryptographic safeguards across the industry. CTIX analysts will continue to report on new and novel vulnerabilities to keep our readers informed about the potential threats to their data.