CVE-2026-42866 Details

An arbitrary file write vulnerability has been identified in Tookie OSINT versions prior to 4.1fix. The issue arises in the 'modules/modules.py' file, specifically within the 'write_txt', 'write_csv', 'write_json', and 'scan_file' helper functions. These functions open output files using a filename derived from the '-u' command-line interface (CLI) flag or from a line in a '-U' usernames file, without proper sanitization. This lack of sanitization allows usernames containing path-separator sequences or absolute paths to be exploited, directing output to arbitrary locations where the user has write permissions. While the vulnerability is somewhat contained by the enforced file extensions, it still permits overwriting existing files and cluttering user-writable directories.

Users are advised to update to Tookie OSINT version 4.1fix or later. Additionally, the username input should be sanitized to remove any path traversal characters before being used as a filename.