CVE-2026-119298

Name of the Vulnerable Software and Affected Versions croc versions prior to 11.5.2

Description The receive-side file-readiness loop in src/croc/croc.go incorrectly treats any sender-controlled basename starting with croc-stdin- as a trusted text-transfer artifact, even when SendingText is false. This behavior bypasses the askReceiveOverwrite and rename processes during a predictable exact-name collision in the receiver's working directory. Consequently, a remote sender whose transfer is accepted can overwrite or truncate a matching regular file via recipientInitializeFile, or replace a matching destination with an empty file or an in-directory symlink via createEmptyFileAndFinish without confirmation. The impact is restricted to predictable names within the croc-stdin- namespace; other filenames still require confirmation, dotfiles outside this namespace are inaccessible, and symlink targets are confined to the receive directory.

Recommendations Update to version 11.5.2.