CVE-2026-78385
Received Received - Intake

Server-Side Request Forgery in RansomLook PDF Generation

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: CIRCL

Description
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions. An authenticated attacker able to create or modify an analysis could embed crafted resource references using schemes such as file:// or http://. When the analysis was subsequently rendered as PDF, WeasyPrint would process these references with the privileges and network access of the RansomLook server. A malicious file:// reference could cause the renderer to access arbitrary files readable by the RansomLook process, potentially exposing sensitive configuration, credentials, or other local data through rendered resources. Network URLs could cause the server to initiate requests to localhost, internal network services, or external systems, resulting in server-side request forgery (SSRF) and potentially bypassing network-level access restrictions. The patch introduces a dedicated WeasyPrint URL fetcher that permits only data: resources, the RansomLook report logo, and files contained within the analysis asset directory. Network resources and filesystem paths outside these explicitly permitted locations are rejected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78385
EUVD
EUVD-2026-64886

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ransomlook weasyprint to 5a6e4751-2f3f-4070-9419-94fb35b644e8 (exc)
ransomlook ransomlook *
weasyprint weasyprint *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RansomLook has a flaw where PDF generation from Markdown to HTML using WeasyPrint did not restrict resource references. An attacker with analysis creation rights could embed file:// or http:// URLs in the content. When rendered, this could let the server access arbitrary local files or make network requests, leading to data exposure or SSRF attacks.

Detection Guidance

To detect this vulnerability, monitor for unauthorized file access or SSRF attempts during PDF generation. Check logs for WeasyPrint processes accessing unexpected file:// or http:// resources. Inspect network traffic for outbound requests from the RansomLook server to localhost or internal systems.

Impact Analysis

If exploited, this could allow unauthorized access to sensitive files on the server, leak credentials or configurations, or enable network probing of internal systems. Attackers might bypass access controls to retrieve data or interact with restricted services.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with access controls, and failure to protect sensitive information, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Apply the patch from the RansomLook repository commit 34dc028 to restrict resource access during PDF generation. Ensure the new _pdf_url_fetcher is enabled and only allows data: resources, report logos, and analysis assets. Review and sanitize user-controlled input paths in logo and analysis features.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart