Arbitrary File Write

github.com/schollz/croc is vulnerable to Arbitrary File Write through crafted File Paths. The vulnerability is due to the Croc protocol which allows senders to specify sn arbitrary path for a file transfer. If the recipient doesn’t already have a file with the same name, an attacker can exploit this to write files beyond the intended directory by altering file paths without the recipient’s notice. By guessing or determine the receiver’s home directory path, and using relative paths such as ../.ssh/authorized_keys, an attacker can potentially compromise the recipient’s system.