CVE-2026-78385 in RansomLook
Summary
by MITRE • 08/24/2026
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions.
An authenticated attacker able to create or modify an analysis could embed crafted resource references using schemes such as file:// or http://. When the analysis was subsequently rendered as PDF, WeasyPrint would process these references with the privileges and network access of the RansomLook server.
A malicious file:// reference could cause the renderer to access arbitrary files readable by the RansomLook process, potentially exposing sensitive configuration, credentials, or other local data through rendered resources. Network URLs could cause the server to initiate requests to localhost, internal network services, or external systems, resulting in server-side request forgery (SSRF) and potentially bypassing network-level access restrictions.
The patch introduces a dedicated WeasyPrint URL fetcher that permits only data: resources, the RansomLook report logo, and files contained within the analysis asset directory. Network resources and filesystem paths outside these explicitly permitted locations are rejected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
RansomLook contains an insufficient resource validation vulnerability in its PDF generation functionality, which allows authenticated attackers to exploit server-side request forgery and arbitrary file read conditions through crafted Markdown content. The application converts analysis documents from Markdown to HTML before passing them to the WeasyPrint library for rendering into portable document format files. Prior to the security patch, WeasyPrint utilized a default URL fetcher that lacked strict restrictions on resource resolution protocols. This architectural oversight permitted any valid Uniform Resource Identifier scheme embedded within an analysis report to be processed by the server without adequate validation or sanitization checks against malicious intent.
An authenticated attacker with permissions to create or modify analyses could embed specially crafted resource references utilizing schemes such as file:// for local filesystem access or http:// and https:// for network requests. When the system subsequently rendered these documents into PDFs, WeasyPrint executed these references using the privileges and network access context of the RansomLook server process. This behavior effectively transformed a document rendering feature into an attack vector capable of interacting with internal infrastructure and sensitive local storage areas that are normally inaccessible to end users or external networks.
The exploitation of file:// scheme references allows the renderer to read arbitrary files accessible by the operating system user running the RansomLook application. This capability can lead to the exposure of highly sensitive data including configuration files, database credentials, private keys, and other local artifacts stored on the server filesystem. By embedding such paths in Markdown content, an attacker could trigger the inclusion of these restricted resources directly into the generated PDF output, thereby leaking confidential information through a seemingly benign document generation workflow that relies on client-side rendering assumptions rather than server-side security controls.
Furthermore, the use of network-based schemes like http:// enables server-side request forgery attacks against localhost addresses and internal network services. The RansomLook server initiates outbound requests to resolve these resources, effectively acting as an intermediary proxy for the attacker. This mechanism can bypass firewalls and access control lists that restrict direct external connections by leveraging trusted internal IP ranges or loopback interfaces. Attackers may probe internal APIs, database ports, or management consoles, potentially leading to further compromise of the broader network environment through unauthorized interactions with backend services that trust requests originating from localhost.
The remediation strategy involves implementing a dedicated WeasyPrint URL fetcher that enforces strict allowlisting policies for resource loading. This patch restricts permitted resources exclusively to data URIs containing inline content, specific static assets such as the RansomLook report logo located in designated directories, and files strictly confined within the analysis asset directory structure. Any attempt to reference network URLs or filesystem paths outside these explicitly authorized locations is now rejected by the rendering engine. This defense-in-depth approach ensures that document generation remains isolated from external network interactions and prevents traversal beyond intended application boundaries.
This vulnerability aligns with Common Weakness Enumeration identifiers such as CWE-20 for Improper Input Validation, which describes failures to validate or incorrectly validate input against expected constraints. Additionally, the exploitation technique corresponds to ATT&CK tactic T1557, specifically subtechnique T1557.001 known as Adversary-in-the-Middle, where an attacker uses a compromised system to relay traffic and interact with internal resources that would otherwise be inaccessible due to network segmentation or access controls. The fix addresses these risks by enforcing strict resource isolation during the rendering phase, thereby mitigating both information disclosure and lateral movement opportunities within the target environment.