CVE-2026-42866: Tookie OSINT Path Traversal Vulnerability

CVE-2026-42866 Overview

CVE-2026-42866 is a path traversal vulnerability [CWE-22] in tookie-osint, an open-source OSINT information gathering tool. Versions prior to 4.1fix contain unsanitized username handling in modules/modules.py. The write_txt, write_csv, write_json, and shipped-but-commented scan_file helpers open output files using open(f"{user}.<ext>") where user derives directly from the -u CLI flag or any line of a -U usernames file. Attackers supplying usernames containing .., /, \, or absolute paths can redirect output writes to arbitrary locations accessible to the invoking user. The maintainer fixed this issue in release 4.1fix.

Critical Impact
A crafted username value causes tookie-osint to write scan output to any filesystem path writable by the executing user, enabling arbitrary file overwrite.

Affected Products

tookie-osint versions prior to 4.1fix
modules/modules.py output helpers: write_txt, write_csv, write_json
Shipped scan_file helper (commented but present in source)

Discovery Timeline

2026-05-11 - CVE-2026-42866 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42866

Vulnerability Analysis

The defect resides in the output-writing helpers within modules/modules.py. Each helper constructs an output filename through Python f-string interpolation: open(f"{user}.txt"), open(f"{user}.csv"), and open(f"{user}.json"). The user variable flows directly from user-controlled input without validation, normalization, or basename extraction. When tookie-osint runs against a username such as ../../etc/cron.d/payload, the helper opens that path relative to the process working directory and writes attacker-influenced scan output. The flaw classifies as path traversal [CWE-22] because the application fails to constrain the resolved path to a designated output directory.

Root Cause

The root cause is missing input sanitization on the -u and -U command-line parameters. The helpers treat the username as a safe filename component. Python's open() honors path separators and parent-directory references inside the string argument. No os.path.basename() call, allowlist regex, or output-directory join restricts where files land.

Attack Vector

Exploitation requires local invocation of tookie-osint with attacker-influenced input. An operator running the tool against a -U usernames.txt file controlled by an adversary, or an automation pipeline that forwards untrusted usernames into the -u flag, triggers the write. The resulting file inherits the invoking user's write permissions, allowing overwrite of configuration files, dotfiles, cron entries, or shell startup scripts within the user's reach. The vulnerability does not yield remote code execution directly but provides a primitive for privilege escalation or persistence when chained with writable system locations.

No verified public exploit code is published. Refer to the GitHub Security Advisory GHSA-rp68-wfv6-3cq3 for maintainer details.

Detection Methods for CVE-2026-42866

Indicators of Compromise

Files written by the tookie-osint process outside its expected output directory, especially with .txt, .csv, or .json extensions containing scan result fields.
Username inputs in -U files or shell history containing .., forward or backward slashes, or absolute path prefixes.
Unexpected modifications to dotfiles, cron directories, or service unit files timestamped to tookie-osint execution windows.

Detection Strategies

Audit shell history and process accounting logs for tookie-osint invocations with suspicious -u or -U argument content.
Scan stored usernames files for path separator characters before they are consumed by automation.
Monitor file integrity on user-writable system paths such as ~/.bashrc, ~/.ssh/authorized_keys, and ~/.config/ for writes originating from Python processes running tookie-osint.

Monitoring Recommendations

Enable Linux auditd rules on execve for the tookie-osint binary capturing full command-line arguments.
Alert on file create events where the writing process is python or tookie-osint and the destination lies outside the project output directory.
Centralize host telemetry so analysts can correlate tookie-osint executions with subsequent suspicious file modifications.

How to Mitigate CVE-2026-42866

Immediate Actions Required

Upgrade tookie-osint to release 4.1fix or later on every system where the tool is installed.
Treat all -U username files as untrusted input and sanitize entries before invocation.
Run tookie-osint under a dedicated low-privilege account with a restricted working directory.

Patch Information

The maintainer addressed the issue in tookie-osint 4.1fix. The fix applies sanitization to the user value before it reaches the output helpers in modules/modules.py. Review the GitHub Security Advisory GHSA-rp68-wfv6-3cq3 for the upstream commit and release notes.

Workarounds

Pre-filter usernames with a regex that allows only alphanumerics, hyphen, underscore, and dot, rejecting any path separator or .. sequence.
Execute tookie-osint inside a container or chroot with a writable scratch directory and read-only system paths.
Apply mandatory access controls such as AppArmor or SELinux profiles that restrict the tookie-osint process to a single output directory.

bash

# Configuration example - sanitize usernames before invocation
grep -E '^[A-Za-z0-9_.-]+$' usernames.txt > usernames.clean.txt
tookie-osint -U usernames.clean.txt