Tookie is an OSINT collection utility that writes output files by concatenating the raw username string supplied through the –u command‑line flag or a –U usernames file. Because the input is not sanitized, a username that contains path‐separator sequences such as .., /, or \ causes the tool to create a file at an arbitrary location on the filesystem. This vulnerability, identified as CWE‑22 and CWE‑73, allows an attacker who can run Tookie with file‑write permissions to overwrite existing files, place malicious content, or modify configuration files, thereby compromising data integrity and potentially enabling privilege escalation.

The flaw exists in all releases of Alfredredbird’s Tookie OSINT that precede the 4.1fix version. Any installation of the 4.x series that has not been upgraded to 4.1fix or later is susceptible and should be considered at risk when the tool is executed with untrusted username input.

The CVSS base score of 6.7 indicates a moderate severity. The EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors include local execution by a user who has write access to the target filesystem, or remote execution if the tool is run in a service context with elevated privileges. Successful exploitation permits overwriting arbitrary files, which can compromise system configuration, enable persistence, or facilitate further attacks.