{"id":"CVE-2026-119298","kind":"vulnerability","aliases":["CVE-2026-119298"],"related":[],"title":"croc: sender can overwrite predictable croc-stdin files without confirmation","description":"croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite or truncate a matching regular file through recipientInitializeFile, or to remove and replace a matching destination with an empty file or an in-directory symlink through createEmptyFileAndFinish, without confirmation. The impact is limited to pre-existing names in the croc-stdin- namespace that the sender can predict; other filenames retain the prompt, dotfiles outside that namespace are not reachable, and symlink targets remain confined to the receive directory. This issue is fixed in version 11.5.2.","summary":"croc, a tool for sending files between two computers, skips its overwrite prompt for files whose names start with croc-stdin- even when the transfer is a normal file transfer. A remote sender whose transfer the user accepted can then overwrite, truncate, or replace a matching file in the receiver's working directory.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["croc","file-transfer","go","package"],"not_affected_if":["no-croc-stdin-files-in-receive-dir","version-11.5.2-or-later"],"how_to_check":"- Check the installed croc version with `croc --version`; versions below `11.5.2` are affected.\n- Look for files named `croc-stdin-*` in the directories where you receive transfers.","fix":"- croc: move to `11.5.2` or later.","status":"open","published_at":"2026-10-30T17:17:18+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:19+00:00","updated_at":"2026-10-30T17:32:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T17:32:19Z","model":"claude-haiku-5-5","output":{"fix":"- croc: move to `11.5.2` or later.","reach":"internet","title":"croc: sender can overwrite predictable croc-stdin files without confirmation","impact":"low","summary":"croc, a tool for sending files between two computers, skips its overwrite prompt for files whose names start with croc-stdin- even when the transfer is a normal file transfer. A remote sender whose transfer the user accepted can then overwrite, truncate, or replace a matching file in the receiver's working directory.","audience":"developers","category":"package","nicknames":[],"who_cares":["croc","file-transfer","go"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"a matching local file is overwritten or replaced without confirmation","analyst_note":"","how_to_check":"- Check the installed croc version with `croc --version`; versions below `11.5.2` are affected.\n- Look for files named `croc-stdin-*` in the directories where you receive transfers.","plain_action":"","needs_analyst":false,"not_affected_if":["version-11.5.2-or-later","no-croc-stdin-files-in-receive-dir"],"who_is_affected":"Anyone who runs croc to receive files from another computer before version 11.5.2. The impact is limited to pre-existing files whose names start with croc-stdin- in the receiving directory; other filenames still get the overwrite prompt, and symlink targets stay inside the receive directory.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4341,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119298':14A,17A '-2026':13A,16A '11.5.2':97C,238C 'accept':62B,158C 'allow':83C,150C 'artifact':125C 'askreceiveoverwrit':133C 'basenam':113C 'begin':114C 'collis':143C 'comput':32B,86C 'confin':227C 'confirm':11A,190C 'control':112C 'createemptyfileandfinish':188C 'croc':1A,7A,18B,24B,44B,78C,117C,203C 'croc-stdin':6A,43B,116C,202C 'cve':12A,15A 'destin':176C 'directori':77B,149C,185C,231C 'dotfil':216C 'empti':179C 'even':46B,126C 'exact':141C 'exact-nam':140C 'exist':198C 'fals':130C 'file':9A,20B,29B,38B,53B,71B,92C,103C,166C,180C 'file-readi':102C 'file-transf':19B 'filenam':212C 'fix':235C 'folder':94C 'go':22B 'handl':136C 'impact':192C 'in-directori':183C 'issu':233C 'limit':194C 'loop':105C 'match':70B,164C,175C 'name':40B,142C,199C 'namespac':205C,219C 'normal':52B 'outsid':217C 'overwrit':4A,35B,65B,160C 'packag':23B 'pre':197C 'pre-exist':196C 'predict':5A,139C,210C 'prior':95C 'prompt':36B,215C 'reachabl':222C 'readi':104C 'receiv':74B,100C,146C,230C 'receive-sid':99C 'recipientinitializefil':168C 'regular':165C 'remain':226C 'remot':56B,152C 'remov':171C 'renam':135C 'replac':68B,173C 'retain':213C 'secur':90C 'send':28B 'sender':2A,57B,111C,153C,208C 'sender-control':110C 'sendingtext':128C 'side':101C 'simpli':88C 'skip':33B,132C 'src/croc/croc.go':107C 'start':41B 'stdin':8A,45B,118C,204C 'symlink':186C,224C 'target':225C 'text':123C 'text-transf':122C 'tool':26B,81C 'transfer':21B,49B,54B,59B,91C,124C,155C 'treat':108C 'truncat':66B,162C 'trust':121C 'two':31B,85C 'user':61B,157C 'version':237C 'whose':39B,58B,154C 'without':10A,189C 'work':76B,148C","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs croc to receive files from another computer before version 11.5.2. The impact is limited to pre-existing files whose names start with croc-stdin- in the receiving directory; other filenames still get the overwrite prompt, and symlink targets stay inside the receive directory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119298","severity":null,"published_at":"2026-10-30T17:17:18+00:00","modified_at":"2026-10-30T17:17:18+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}