RansomLook contains a Redis glob pattern injection flaw that stems from insufficient neutralization of user supplied input before it is used in SCAN MATCH patterns. An unauthenticated attacker can send a request such as /api/health/*, injecting glob metacharacters like *, ?, [ or ], causing the SCAN operation to expand beyond the intended group, thereby exposing health information, mirror slugs, uptime series, and other entries marked private. Similar unsafe interpolation exists in /api/crypto/chain/<chain> and in delete_manual_torrent(), where a crafted infohash could cause unwanted matches against torrent-health keys, potentially leading to data exposure or deletion. This weakness corresponds to CWE‑200, leading to information disclosure and the possibility of destructive actions.

The vulnerability affects the RansomLook application, specifically the ransomlook product. Any deployed instance containing the unpatched code is susceptible; no version numbers are specified in the advisory.

The CVSS score of 6.9 indicates a medium severity for disclosure. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote over HTTP, requiring no authentication. An attacker can trigger vulnerable endpoints and enumerate private data or, by abusing delete_manual_torrent, potentially delete data belonging to other torrents. The exploitation requires only a crafted HTTP request and basic knowledge of the endpoint structure.