Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119298— croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive

Quick assessment

Affected
schollz croc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Croc 是一款允许任意两台计算机简单、安全地传输文件和文件夹的工具。在 11.5.2 版本之前， 中接收端的文件就绪循环会将任何由发送方控制、以 开头的文件名（basename）视为受信任的文本传输产物，即使 标志为 也是如此。这种行为会跳过 和重命名处理逻辑，导致接收方工作目录中出现可预测的精确文件名冲突。攻击者可利用此漏洞，在用户接受传输后，通过 覆盖或截断匹配的正则文件；或通过 移除并替换匹配的目的地文件，将其替换为空文件或指向目录内部的符号链接，且无需用户确认。该漏洞的影响范围仅限于发送方可预测的、位于

CVSS 4.2 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
schollz croc < 11.5.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119298

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive
Source: CVE Program / CVE List V5
Vulnerability Description
croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite or truncate a matching regular file through recipientInitializeFile, or to remove and replace a matching destination with an empty file or an in-directory symlink through createEmptyFileAndFinish, without confirmation. The impact is limited to pre-existing names in the croc-stdin- namespace that the sender can predict; other filenames retain the prompt, dotfiles outside that namespace are not reachable, and symlink targets remain confined to the receive directory. This issue is fixed in version 11.5.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
schollz croc < 11.5.2 -

II. Public POCs for CVE-2026-119298

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119298

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-119298 (2)

Vendor Advisories for CVE-2026-119298 (1)

Vendor Pages for CVE-2026-119298 (1)

IV. Related Vulnerabilities

Same weakness: CWE-73