Loading story…
A high-severity vulnerability in the croc end-to-end encrypted file transfer tool allows a malicious sender to delete arbitrary files on a recipient system by sending a file named croc-marked-files.txt. Affected versions are 10.0.13 through 11.0.2. The bug stems from croc treating that received filename as its internal cleanup list and passing attacker-controlled entries directly to file-deletion logic without validating absolute paths or ../ traversal sequences, enabling removal of writable files and empty directories outside the intended transfer location.
Researchers said the flaw can be chained into remote code execution when a victim runs croc from their home directory: an attacker can first delete a shell initialization file such as ~/.bashrc and then send a malicious replacement that executes on the next shell start. The risk is higher when croc is used with --yes, which can silently accept both transfers. The issue was reported on 2026-08-10, fixed the same day in version 11.0.3 via commit c0d51f0 and PR #1232, which moved cleanup tracking into memory and restricted deletions to local paths; no CVE had been assigned at disclosure.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was publicly disclosed on oss-sec and in a GitHub gist, describing arbitrary file deletion in croc versions 10.0.13 through 11.0.2 and an RCE chain via replacement of shell init files such as .bashrc. The disclosure noted the issue had no CVE or formal security advisory and that version 11.0.3 contained the fix.
A security-related fix was merged into the croc main branch through commit c0d51f0 and PR #1232. The patch changed cleanup handling to keep marked files in memory and reject non-local paths, and bumped the version from 11.0.2 to 11.0.3.
Anas Souiri reported a vulnerability in croc that lets a malicious sender trigger arbitrary file deletion on the receiving host via a transferred "croc-marked-files.txt" file. The oss-sec disclosure states the issue was reported through GitHub Security Advisory and email on the same day it was fixed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcegist.github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting critical vulnerabilities in **Cleo Harmony**, **Cleo VLTrader**, and **Cleo LexiCom** managed file transfer software, including `CVE-2024-50623` and the related `CVE-2024-55956`. The flaws affect versions prior to **5.8.0.24** and allow remote, unauthenticated attackers to upload arbitrary files, execute commands, access sensitive data, and alter systems. Security researchers and vendor advisories reported in-the-wild exploitation, with public proof-of-concept exploit code increasing the risk of broad compromise. Intrusions linked to the campaign have been associated with **Clop** data-theft activity, and exploitation was observed from at least early December 2024. Defenders were urged to immediately upgrade affected Cleo products to **5.8.0.24 or later**, restrict external access to exposed file transfer servers, and review logs, autorun locations, and other persistence points for suspicious files or commands. The incident adds Cleo software to the list of heavily targeted file transfer platforms exploited for large-scale enterprise breaches.
Jul 24, 2026
A critical vulnerability in Cleo managed file-transfer software has been actively exploited in the wild, with CISA confirming its use in ransomware attacks and adding the flaw to its Known Exploited Vulnerabilities catalog. Reporting indicates the bug affects Cleo products used for secure file exchange, and defenders were urged to patch immediately, restrict internet exposure, and investigate signs of compromise as exploitation spread broadly. Further reporting tied the campaign to activity dating back to October, with Mandiant tracing exploitation earlier than initially disclosed and indicating attackers had been abusing the Cleo flaw for weeks before public warnings intensified. The overlap between mass exploitation, confirmed ransomware use, and the extended dwell time raised concern that organizations relying on Cleo software may have been compromised well before detection and should review logs, isolate affected systems, and assess for follow-on intrusion activity.
Jul 12, 2026
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source **File Browser** self-hosted file management application, including **`CVE-2026-73611`**, **`CVE-2026-73612`**, and **`CVE-2026-73613`**. The issues affect File Browser/File Server releases up to **2.63.21** in the broader advisory, while individual fixes were introduced in later versions, including **2.63.22** for the recursive-operations access-control flaw and **2.63.19** as unaffected for the symlink-based deletion issue. `CVE-2026-73612` allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. `CVE-2026-73613` enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, `CVE-2026-73611` affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
Aug 14, 2026