Severe flaws in E2EE cloud storage platforms used by millions

Researchers at ETH Zurich reported multiple serious cryptographic and protocol flaws across five end-to-end encrypted cloud storage services (Sync, pCloud, Icedrive, Seafile, Tresorit) that, under a realistic 'compromised server' threat model, can allow a malicious server to inject files, tamper with or reorder file chunks, replace or overwrite key material, and in some cases decrypt shared content; the issues affect millions of users, vendor responses vary (Tresorit fared relatively better) and no active exploitation has been reported.