Croc is a peer-to-peer file transfer tool that has a vulnerability allowing an attacker to bypass the overwrite confirmation prompt on the receiving side by using filenames starting with 'croc-stdin-'. This bypass enables silent overwriting, truncation, or replacement of existing files, including symlink substitution, without user confirmation. The flaw arises because the overwrite prompt is suppressed based solely on the filename prefix rather than the transfer type, allowing any sender to exploit this behavior. The issue affects multiple versions prior to 11.5.2 and was introduced by a design decision to avoid prompts for croc's internal text-transfer artifacts. A fix is available in version 11.5.2.