Description
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions.

An authenticated attacker able to create or modify an analysis could embed crafted resource references using schemes such as file:// or http://. When the analysis was subsequently rendered as PDF, WeasyPrint would process these references with the privileges and network access of the RansomLook server.

A malicious file:// reference could cause the renderer to access arbitrary files readable by the RansomLook process, potentially exposing sensitive configuration, credentials, or other local data through rendered resources. Network URLs could cause the server to initiate requests to localhost, internal network services, or external systems, resulting in server-side request forgery (SSRF) and potentially bypassing network-level access restrictions.

The patch introduces a dedicated WeasyPrint URL fetcher that permits only data: resources, the RansomLook report logo, and files contained within the analysis asset directory. Network resources and filesystem paths outside these explicitly permitted locations are rejected.
Published: 2026-08-24
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Patch Now
AI Analysis

Impact

RansomLook's PDF generation process converts Markdown into HTML and renders it with WeasyPrint. The former used the default URL fetcher, permitting arbitrary resource fetching when generating PDFs. An authenticated attacker can embed crafted ``file://`` or ``http://`` references in an analysis, causing the server to read local files or make outbound requests while rendering the PDF. This flaw can expose configuration and credential data and enable server‑side request forgery (SSRF).

Affected Systems

The vulnerability affects RansomLook RansomLook. No specific product versions are listed, so any deployment of RansomLook that has not applied the documented fix is vulnerable.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity. Although no EPSS data is available, the lack of restriction on resource resolution creates a clear exploitation path for users who can modify analyses. The vulnerability is not listed in CISA's KEV catalog, but the impact on confidentiality and the potential for SSRF warrant prompt remediation.

Generated by OpenCVE AI on August 24, 2026 at 20:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest RansomLook patch that implements a restricted WeasyPrint URL fetcher.
  • Prevent unauthenticated or unauthorized users from creating or editing analyses until the patch is deployed.
  • Configure the application or infrastructure to block URL resolution in PDF rendering and isolate the server from internal networks to limit SSRF exposure.

Generated by OpenCVE AI on August 24, 2026 at 20:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Ransomlook
Ransomlook ransomlook
Vendors & Products Ransomlook
Ransomlook ransomlook

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions. An authenticated attacker able to create or modify an analysis could embed crafted resource references using schemes such as file:// or http://. When the analysis was subsequently rendered as PDF, WeasyPrint would process these references with the privileges and network access of the RansomLook server. A malicious file:// reference could cause the renderer to access arbitrary files readable by the RansomLook process, potentially exposing sensitive configuration, credentials, or other local data through rendered resources. Network URLs could cause the server to initiate requests to localhost, internal network services, or external systems, resulting in server-side request forgery (SSRF) and potentially bypassing network-level access restrictions. The patch introduces a dedicated WeasyPrint URL fetcher that permits only data: resources, the RansomLook report logo, and files contained within the analysis asset directory. Network resources and filesystem paths outside these explicitly permitted locations are rejected.
Title RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Ransomlook Ransomlook
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-08-24T15:12:12.598Z

Reserved: 2026-08-24T13:49:42.041Z

Link: CVE-2026-78385

cve-icon Vulnrichment

Updated: 2026-08-24T15:12:03.879Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T14:17:05.940

Modified: 2026-08-26T16:49:18.760

Link: CVE-2026-78385

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T20:15:04Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)