# CVE-2026-119298: croc file overwrite vulnerability in text-transfer handling

Source: https://junglewise.ai/threats/cve-2026-119298-croc-is-a-tool-that-allows-any-two-computers-to-simply-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119298 · Severity: medium · CVSS 4.2 · Published 2026-10-30

croc is a secure file-transfer tool that allows users to exchange files between computers. Prior to version 11.5.2, a remote attacker could overwrite or truncate files on the receiving end by exploiting predictable naming patterns in the transfer protocol, bypassing user confirmation. An attacker who initiates a file transfer that the user accepts can manipulate files in the receiver's working directory without explicit approval.

Technologies: [github.com/schollz/croc (Go)](https://junglewise.ai/threats/technologies/github-com-schollz-croc), [github.com/schollz/croc/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-schollz-croc-v6), [github.com/schollz/croc/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-schollz-croc-v8), [github.com/schollz/croc/v9 (Go)](https://junglewise.ai/threats/technologies/github-com-schollz-croc-v9). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-119298 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119298 being exploited in the wild.

**How severe is CVE-2026-119298?** Medium severity, with a CVSS score of 4.2, published 30 October 2026.

**Which products and versions are affected?** github.com/schollz/croc (Go) <= 3.0.6, SEMVER:introduced=0,last_affected=3.0.6; github.com/schollz/croc/v10 (Go) <= 10.7.0, SEMVER:introduced=0,last_affected=10.7.0; github.com/schollz/croc/v11 (Go) < 11.5.2, SEMVER:introduced=0,fixed=11.5.2; github.com/schollz/croc/v6 (Go) <= 6.4.11, SEMVER:introduced=0,last_affected=6.4.11; and 3 more.

**Is there a fix for CVE-2026-119298?** Yes. github.com/schollz/croc/v11 (Go): upgrade to 11.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119298 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119298?** Check whether you run github.com/schollz/croc (Go), github.com/schollz/croc/v10 (Go), github.com/schollz/croc/v11 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/schollz/croc/v11 (Go): upgrade to 11.5.2 or later

  ```sh
  go get github.com/schollz/croc/v11@v11.5.2
  ```


## Technical details

The vulnerability exists in the receive-side file-readiness loop in src/croc/croc.go, where sender-controlled basenames beginning with "croc-stdin-" are treated as trusted text-transfer artifacts regardless of the SendingText flag value. This allows an attacker to skip the askReceiveOverwrite confirmation prompt and rename handling, enabling file overwrite via recipientInitializeFile or file replacement via createEmptyFileAndFinish for predictable collisions in the receiver's working directory.

## Affected products

- schollz croc before 11.5.2

## Identifiers

- CVE-2026-119298
- GHSA-x89h-7h96-v88f

## Timeline

- 2026-10-30: disclosed
- 2026-09-09: patched

## References

- [https://github.com/schollz/croc/commit/25fe49b6f14db99f517e902cfef76299ad0a95a3](https://github.com/schollz/croc/commit/25fe49b6f14db99f517e902cfef76299ad0a95a3)
- [https://github.com/schollz/croc/pull/1327](https://github.com/schollz/croc/pull/1327)

## Related threats

- [GO-2023-2073 - Croc sender may send dangerous new files to receiver in github.com/schollz/croc](https://junglewise.ai/threats/cve-2023-43619-croc-sender-may-send-dangerous-new-files-to-receiver)
- [GO-2023-2069 - Croc may expose secret to local users in github.com/schollz/croc](https://junglewise.ai/threats/cve-2023-43621-croc-may-expose-secret-to-local-users)
- [GO-2023-2072 - Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc](https://junglewise.ai/threats/cve-2023-43617-cros-secrets-may-be-disclosed-to-untrusted-relay)
- [GO-2023-2071 - Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc](https://junglewise.ai/threats/cve-2023-43616-sender-can-cause-a-receiver-to-overwrite-files-during-zip)
- [Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device](https://junglewise.ai/threats/cve-2023-43620-croc-sender-may-place-ansi-or-csi-escape-sequences-in-filename-to)