CVE-2026-119298
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
croc, a tool for securely transferring files and folders between computers, prior to 11.5.2 treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact in the receive-side file-readiness loop (src/croc/croc.go), even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite, truncate, or replace a matching file without confirmation.
Risk Assessment
A remote sender whose transfer the user accepts can overwrite or remove an existing file in the receive directory without confirmation. Impact is limited to predictable names in the croc-stdin- namespace.
Recommendation
Upgrade croc to version 11.5.2 or later. Until then, avoid accepting transfers from untrusted senders into directories containing important files.
Related vulnerabilities
- CVE-2026-4052Critical
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
- CVE-2026-13594Critical
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
- CVE-2026-120534Critical
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Insufficient validation of form configuration parameters allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments.
- CVE-2026-120518Critical
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. The bpxp_image_field_update_on_user_activation() function calls unlink() on a path built from visitor-supplied signup metadata without realpath() resolution, containment check, or extension allow-list.
- CVE-2026-86596Critical
The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.
- CVE-2026-97718Critical
CVE-2026-97718 is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
- CVE-2026-116769Critical
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
- CVE-2026-102435Critical
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation.
- CVE-2026-105606Critical
The Joomla Custom Tables extension before 3.7.8 allows an unauthenticated attacker to upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory. The stored path is disclosed in the response, and the file is served as static content by default.
- CVE-2026-105604Critical
The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unauthenticated SQL injection in the frontend search.
Original NVD description (English source)
croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite or truncate a matching regular file through recipientInitializeFile, or to remove and replace a matching destination with an empty file or an in-directory symlink through createEmptyFileAndFinish, without confirmation. The impact is limited to pre-existing names in the croc-stdin- namespace that the sender can predict; other filenames retain the prompt, dotfiles outside that namespace are not reachable, and symlink targets remain confined to the receive directory. This issue is fixed in version 11.5.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS