CVE-2026-119298: Overwrite Confirmation Bypass in schollz/croc via Unvalidated Text Artifact Prefix

Vulnerability ID: CVE-2026-119298
CVSS Score: 4.2
Published: 2026-11-09

CVE-2026-119298 (GHSA-x89h-7h96-v88f) is a file overwrite confirmation bypass vulnerability in schollz/croc prior to version 11.5.2. The receive-side file validation logic in src/croc/croc.go improperly exempted any incoming file whose basename began with the prefix 'croc-stdin-' from interactive overwrite prompts and automatic collision renaming, failing to verify if the transfer session was actually an internal text transfer. An unauthenticated remote peer participating in a transfer session can exploit this flaw to silently overwrite, truncate, or replace matching pre-existing files in the receiver's working directory.

TL;DR

Versions of the Go-based peer-to-peer file transfer utility croc prior to 11.5.2 trust sender-supplied filenames prefixed with 'croc-stdin-' during standard file transfers. This allows an untrusted sender to bypass both interactive overwrite prompts and the --rename flag, silently overwriting or truncating existing files matching that prefix in the receiver's destination directory.

⚠️ Exploit Status: POC

Technical Details

CVE / Advisory ID: CVE-2026-119298 / GHSA-x89h-7h96-v88f
Weakness Class: CWE-73: External Control of File Name or Path
Attack Vector: Network (Peer-to-Peer Transfer Session)
CVSS v3.1 Score: 4.2 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L)
EPSS Score: 0.302% (23.07th Percentile)
Impact: Silent overwrite, truncation, or symlink replacement of 'croc-stdin-*' files
Exploit Status: Unit Test PoC in Upstream Repository
CISA KEV Status: Not Listed

Affected Systems

schollz/croc
croc: < 11.5.2 (Fixed in: 11.5.2)

Code Analysis

Commit: 25fe49b

Reserve the croc-stdin- overwrite/rename exemption for validated text transfers (c.Options.SendingText) and add collision regression tests.

File: src/croc/croc.go @@ -3410,16 +3410,18 @@ func (c *Client) updateIfRecipientHasFileInfo() (err error) { if !hashesEqual { log.Debugf("hashed %s to %x using %s", fileInfo.Name, fileHash, c.Options.HashAlgorithm) log.Debugf("hashes are not equal %x != %x", fileHash, fileInfo.Hash) - isStdinName := strings.HasPrefix(path.Base(fileInfo.Name), "croc-stdin-") - if destinationExists && !isStdinName && c.Options.Rename { + // The croc-stdin- exemption is reserved for validated text transfers, + // whose destination names are generated by the receiver. + isTextArtifact := c.Options.SendingText && strings.HasPrefix(path.Base(fileInfo.Name), "croc-stdin-") + if destinationExists && !isTextArtifact && c.Options.Rename { newName := utils.UnusedFilename(fileInfo.FolderRemote, fileInfo.Name) output, colorEnabled := termui.Output(os.Stderr) fmt.Fprintf(output, "Receiving %s as %s\n", quotedFilename(fileInfo.Name, colorEnabled), quotedFilename(newName, colorEnabled)) c.FilesToTransfer[i].Name = newName fileInfo.Name = newName destinationExists = false } - if destinationExists && !c.Options.Overwrite && !c.Options.Rename && !isStdinName { + if destinationExists && !c.Options.Overwrite && !c.Options.Rename && !isTextArtifact { resumable := fileInfo.Size > 0 && fileInfo.Symlink == "" && recipientFileInfo.Mode().IsRegular() overwrite, promptErr := askReceiveOverwrite(c.clientContext(), fileInfo, resumable) if promptErr != nil {

Commit: 7bc6652

Merge pull request #1327 fixing the croc-stdin- overwrite confirmation bypass.

Exploit Details

GitHub: Upstream unit test TestReceiveStdinNamedFileCollision in src/croc/overwrite_test.go demonstrating overwrite bypass across regular, empty, and symlink files.

Mitigation Strategies

Upgrade schollz/croc to version 11.5.2 or later to enforce session-state validation for text transfer artifacts.
Isolate file reception by executing croc inside dedicated, empty staging directories or by specifying an empty output directory with the --out flag.
Restrict peer-to-peer file transfers to trusted senders and verified transfer code phrases.
Avoid storing persistent data or logs using the 'croc-stdin-' filename prefix inside directories used for file reception.

Remediation Steps:

Check the currently installed version of croc by running 'croc --version'.
If the version is prior to 11.5.2, update the binary via your system package manager, the official release page, or by running 'go install github.com/schollz/croc/v11@v11.5.2'.
Verify the installation reports version 11.5.2 or higher before accepting external file transfers.