A malicious sender can delete arbitrary files (and empty directories) on a receiver's machine (anywhere the receiving user has permission ofc) by sending a file named croc-marked-files.txt. croc uses that exact filename in the current working directory as its internal "delete these temp files on exit" list, and deletes every path it contains without any validation. Because a received file with that name lands in the receiver's working directory (the default receive location), the incoming file becomes the deletion list, and its contents are fully attacker-controlled. Deletion runs automatically when the transfer completes and also on Ctrl-C.
Two functions in src/utils/utils.go implement a cleanup mechanism for temporary files:
const crocRemovalFile = "croc-marked-files.txt"a fixed, relative path resolved against the current working directory.RemoveMarkedFiles()opens that file and runsos.Remove(line)for **every line, with no path validation and no