CVE-2026-42866 — Path Traversal in Tookie OSINT

CVE: CVE-2026-42866
GHSA: GHSA-rp68-wfv6-3cq3
Severity: High
CWE: CWE-22 (Path Traversal), CWE-73 (External Control of File Name or Path)
Affected: Tookie OSINT v4.1 (commit 2841f43)
Fixed: After disclosure via GHSA
Credit: smoke-wolf (Maliq Barnard)

---

The bug

Tookie OSINT is a Python CLI for username enumeration across social platforms. You pass -u username and it writes results to disk as .txt, .csv, or .json.

The output writers in modules/modules.py use the username directly in the file path:

open(f"{user}.json")

No sanitization. Put ../ in the username and the output file lands wherever you want. The forced file extension limits what you can overwrite, but .json configs and .txt logs in predictable locations are fair game. The -U bulk mode reads one username per line, so a poisoned usernames file gives you N writes in one invocation.

Reproduction

$ cd /tmp/empty
$ tookie-osint -u "../../../tmp/tookie_pwned" -o json --skipheaders
$ ls -la /tmp/tookie_pwned.json
-rw-r--r-- ... 5101 bytes /tmp/tookie_pwned.json

Fix

Strip path separators from the username before building the filename, or resolve with os.path.realpath() and refuse to write outside a configured output directory.

Timeline

| Date | Event |
|---|---|
| April 23, 2026 | Found and verified against commit 2841f43 (v4.1) |
| April 23, 2026 | Filed via GitHub Security Advisory (private) |
| April 24, 2026 | GHSA published, CVE assigned |