File Overwrite Vulnerability in Croc Tool by Schollz

CVE-2026-119298

What is CVE-2026-119298?

The Croc tool, developed by Schollz for secure file and folder transfers, contains a vulnerability that allows a remote sender to overwrite files on the recipient's system without confirmation. This occurs when the sender utilizes specific basenames starting with 'croc-stdin-' during the transfer process, enabling them to modify pre-existing files in the receiver's directory. The flaw bypasses essential safety checks, resulting in potential data loss or unwanted file changes on the recipient's end. This issue is addressed in Croc version 11.5.2.

References