Schollz
Monthly
Silent file overwrite and delete-and-replace in the croc receiver's working directory is possible when a remote sender names a transferred file with a 'croc-stdin-' prefix, bypassing the interactive overwrite confirmation; croc versions before 11.5.2 are affected. An attacker who can get a victim to accept a transfer (user interaction required) can truncate, overwrite, or delete-and-substitute an existing file of that exact name, or plant an in-directory symlink, with no 'Overwrite?' prompt, because the receive loop treats the prefix as proof of an internal text artifact instead of checking whether the transfer is actually a text transfer. Impact is bounded: only pre-existing names inside the 'croc-stdin-' namespace that the sender can predict are reachable, there is no read primitive, symlink targets stay confined to the receive directory, and dotfiles cannot be named this way; the assessed severity is low (CVSS 4.2, AC:H/UI:R, I:L/A:L), no CISA KEV entry or confirmed public exploit tooling was identified, and the issue is rated 'this_month' priority rather than an emergency.
An issue was discovered in Croc through 9.6.5. Rated medium severity (CVSS 4.7). Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Silent file overwrite and delete-and-replace in the croc receiver's working directory is possible when a remote sender names a transferred file with a 'croc-stdin-' prefix, bypassing the interactive overwrite confirmation; croc versions before 11.5.2 are affected. An attacker who can get a victim to accept a transfer (user interaction required) can truncate, overwrite, or delete-and-substitute an existing file of that exact name, or plant an in-directory symlink, with no 'Overwrite?' prompt, because the receive loop treats the prefix as proof of an internal text artifact instead of checking whether the transfer is actually a text transfer. Impact is bounded: only pre-existing names inside the 'croc-stdin-' namespace that the sender can predict are reachable, there is no read primitive, symlink targets stay confined to the receive directory, and dotfiles cannot be named this way; the assessed severity is low (CVSS 4.2, AC:H/UI:R, I:L/A:L), no CISA KEV entry or confirmed public exploit tooling was identified, and the issue is rated 'this_month' priority rather than an emergency.
An issue was discovered in Croc through 9.6.5. Rated medium severity (CVSS 4.7). Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Croc through 9.6.5. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.