CVE-2026-119298
Description
A flaw was found in croc. When receiving files, croc automatically treats incoming filenames with a specific prefix as trusted text transfers, skipping the prompt that asks for receiver confirmation before overwriting existing files. A remote sender whose transfer request is accepted can exploit this flaw by sending files with predictable names, allowing them to overwrite, truncate, or replace existing files in the receiver's working directory without confirmation.
Statement
Red Hat rates this vulnerability as having a Moderate severity because exploitation requires explicit recipient approval to initiate the session, and the blast radius is strictly limited to pre-existing files adhering to a specific prefix. An attacker cannot traverse outside the current target directory or silently overwrite arbitrary filenames. Moreover, croc is an interactive command-line utility that is not included in Red Hat Enterprise Linux or core enterprise server environments.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
