croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive
croc is an end-to-end encrypted peer-to-peer file transfer tool. On the receiving side, the confirmation that normally protects an existing file from being overwritten or resumed is skipped whenever the received file's name starts with croc-stdin-, regardless of whether the incoming transfer is actually a text transfer. A sender can therefore name a file croc-stdin-<existing-name> and silently overwrite, truncate, or replace an existing file of that name in the receiver's …