croc allows direct file transfers. Prior to v11.5.2, the receive side treats any filename starting with croc-stdin- as a trusted artifact even when the transfer is not text. This bypasses confirmation prompts and enables a sender to overwrite or truncate existing files in the receiver's working directory that match that pattern, without the user’s awareness. The vulnerability allows an attacker who can send a file to a victim to remove or replace a specific file, potentially leading to data loss.

The vulnerability affects the croc tool provided by schollz, specifically versions earlier than 11.5.2.

CVSS 4.2 indicates a medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exposures require a network connection from the attacker to the victim's croc instance and user acceptance of the transfer, making it a remote attack that can overwrite local files. Given the lack of public exploitation data, the risk remains moderate but still warrants attention, especially in environments where critical files could be targeted.