CVE-2026-42866 Tookie: Arbitrary file write via path traversal in -u username / -U userfile output filename
Attackers can write arbitrary files to the filesystem by supplying malicious usernames with path traversal sequences to the Tookie OSINT tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-42866?
CVE-2026-42866 is a medium-severity path traversal vulnerability in Alfredredbird tookie-osint, published on 11 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's write_txt, write_csv, write_json, and (commented-but-shipping) scan_file helpers open their output as open(f"{user}.<ext>"), where user comes unsanitized from the -u CLI flag or any line of a -U usernames file. A username that contains path-separator sequences (.., /, \, or an absolute path) causes tookie-osint to write the scan output to an arbitrary path the invoking user has write permission for. This vulnerability is fixed in 4.1fix.
Which versions are affected by CVE-2026-42866?
How do I fix CVE-2026-42866?
No fix has been published for CVE-2026-42866 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-42866 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42866 exists.
Sources
Also known as GHSA-rp68-wfv6-3cq3.