CVE-2026-78385

RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access

Published Aug 24, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions.

An authenticated attacker able to create or modify an analysis could embed crafted resource references using schemes such as file:// or http://. When the analysis was subsequently rendered as PDF, WeasyPrint would process these references with the privileges and network access of the RansomLook server.

A malicious file:// reference could cause the renderer to access arbitrary files readable by the RansomLook process, potentially exposing sensitive configuration, credentials, or other local data through rendered resources. Network URLs could cause the server to initiate requests to localhost, internal network services, or external systems, resulting in server-side request forgery (SSRF) and potentially bypassing network-level access restrictions.

The patch introduces a dedicated WeasyPrint URL fetcher that permits only data: resources, the RansomLook report logo, and files contained within the analysis asset directory. Network resources and filesystem paths outside these explicitly permitted locations are rejected.

Analysis

Technical impact

RansomLook's PDF generation process converts Markdown into HTML and renders it with WeasyPrint. The former used the default URL fetcher, permitting arbitrary resource fetching when generating PDFs. An authenticated attacker can embed crafted ``file://`` or ``http://`` references in an analysis, causing the server to read local files or make outbound requests while rendering the PDF. This flaw can expose configuration and credential data and enable server‑side request forgery (SSRF).

Affected Systems

The vulnerability affects RansomLook RansomLook. No specific product versions are listed, so any deployment of RansomLook that has not applied the documented fix is vulnerable.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity. Although no EPSS data is available, the lack of restriction on resource resolution creates a clear exploitation path for users who can modify analyses. The vulnerability is not listed in CISA's KEV catalog, but the impact on confidentiality and the potential for SSRF warrant prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ransomlook

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.0.0

No data.

Vendor Product Versions

Ransomlook

Version	Status	Scheme	Platform
`[0,2.0.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest RansomLook patch that implements a restricted WeasyPrint URL fetcher.
Prevent unauthenticated or unauthorized users from creating or editing analyses until the patch is deployed.
Configure the application or infrastructure to block URL resolution in PDF rendering and isolate the server from internal networks to limit SSRF exposure.

Generated by OpenCVE AI on August 24, 2026 at 20:08 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.412% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/RansomLook/RansomLook/commit/34dc0285583dae483b4d48c8e98fff942b755f5f

History

Aug 24, 2026 5:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ransomlook Ransomlook ransomlook
Vendors & Products		Ransomlook Ransomlook ransomlook

Aug 24, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 24, 2026 2:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions. An authenticated attacker able to create or modify an analysis could embed crafted resource references using schemes such as file:// or http://. When the analysis was subsequently rendered as PDF, WeasyPrint would process these references with the privileges and network access of the RansomLook server. A malicious file:// reference could cause the renderer to access arbitrary files readable by the RansomLook process, potentially exposing sensitive configuration, credentials, or other local data through rendered resources. Network URLs could cause the server to initiate requests to localhost, internal network services, or external systems, resulting in server-side request forgery (SSRF) and potentially bypassing network-level access restrictions. The patch introduces a dedicated WeasyPrint URL fetcher that permits only data: resources, the RansomLook report logo, and files contained within the analysis asset directory. Network resources and filesystem paths outside these explicitly permitted locations are rejected.
Title		RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access
Weaknesses		CWE-918
References		https://github.com/RansomLook/RansomLook/commit/34dc0285583dae483b4d48c8e98fff942b755f5f
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}`