- Severity: MEDIUM
- CVE: CVE-2026-119298
- Ecosystems: go, go, go, go, go, go
- Packages: github.com/schollz/croc/v11, github.com/schollz/croc/v10, github.com/schollz/croc/v9, github.com/schollz/croc/v8, github.com/schollz/croc/v6, github.com/schollz/croc
## Summary
croc is an end-to-end encrypted peer-to-peer file transfer tool. On the receiving side, the confirmation that normally protects an existing file from being overwritten or resumed is skipped whenever the received file’s name starts with `croc-stdin-`, regardless of whether the incoming transfer is actually a text transfer. A sender can therefore name a file `croc-stdin-` and silently overwrite, truncate, or replace an existing file of that name in the receiver’s working directory – including removing the existing file and substituting a symlink – without the `Overwrite?` prompt that the standard path requires. The exemption was introduced to keep croc’s internal text-transfer artifacts from triggering prompts, but it is keyed on the filename prefix rather than on the transfer type, so any ordinary file transfer can claim the exemption.
## Vulnerability Details
Affected code at commit `b6f27da9401f2c3647c1adb6b77a46bb8c0923d2` (HEAD, v11.5.1+1):
The receive-side file-readiness loop in `src/croc/croc.go` decides whether to prompt before overwriting or resuming an existing destination file. The decision is made around line 3413:
“`go
isStdinName := strings.HasPrefix(path.Base(fileInfo.Name), “croc-stdin-“)
…
if destinationExists && !c.Options.Overwrite && !c.Options.Rename && !isStdinName {
resumable := fileInfo.Size > 0 && fileInfo.Symlink == “” && recipientFileInfo.Mode().IsRegular()
overwrite, promptErr := askReceiveOverwrite(c.clientContext(), fileInfo, r…
Source: GitHub Security Advisories · 2026-11-09