CVE-2026-119298 croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive

croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is...

CVE-2026-119298

The croc file transfer tool is vulnerable to an overwrite-confirmation bypass in versions prior to 11.5.2 . The issue exists in the receive-side file-readiness loop within src/croc/croc.go, where sender-controlled basenames starting with croc-stdin- are incorrectly treated as trusted text-transfe...

CVE-2026-119298 croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive

croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is...