Arbitrary File Write Vulnerability in Tookie OSINT Tool by Alfredredbird

CVE-2026-42866

What is CVE-2026-42866?

The Tookie OSINT information gathering tool contains an arbitrary file write vulnerability in versions prior to 4.1fix. This issue arises from unsanitized user input, where the tool opens output files using a user-supplied string derived from CLI arguments. If an attacker provides a username that includes path-separating characters, it enables them to dictate the output file location, potentially causing the tool to write files to any directory where the invoking user has write permissions. This vulnerability poses significant risk as it could lead to unauthorized data manipulation or overwriting of files.

References