---
id: "CVE-2026-119298"
kind: "vulnerability"
aliases: ["CVE-2026-119298"]
title: "croc: sender can overwrite predictable croc-stdin files without confirmation"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["croc", "file-transfer", "go", "package"]
not_affected_if: ["no-croc-stdin-files-in-receive-dir", "version-11.5.2-or-later"]
published_at: "2026-10-30T17:17:18+00:00"
first_seen_at: "2026-10-30T17:31:39+00:00"
updated_at: "2026-10-30T17:32:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119298", "first_seen_at": "2026-10-30T17:31:39+00:00"}]
---

# croc: sender can overwrite predictable croc-stdin files without confirmation

croc, a tool for sending files between two computers, skips its overwrite prompt for files whose names start with croc-stdin- even when the transfer is a normal file transfer. A remote sender whose transfer the user accepted can then overwrite, truncate, or replace a matching file in the receiver's working directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed croc version with `croc --version`; versions below `11.5.2` are affected.
- Look for files named `croc-stdin-*` in the directories where you receive transfers.

## Fix

- croc: move to `11.5.2` or later.

## Timeline

- 2026-10-30T17:31:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119298

## From the sources

croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite or truncate a matching regular file through recipientInitializeFile, or to remove and replace a matching destination with an empty file or an in-directory symlink through createEmptyFileAndFinish, without confirmation. The impact is limited to pre-existing names in the croc-stdin- namespace that the sender can predict; other filenames retain the prompt, dotfiles outside that namespace are not reachable, and symlink targets remain confined to the receive directory. This issue is fixed in version 11.5.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_