CVE-2026-78381: RansomLook Path Traversal Vulnerability

CVE-2026-78381 Overview

CVE-2026-78381 is a path traversal vulnerability [CWE-22] in RansomLook, a ransomware group tracking application. The flaw resides in the GroupPost.get API handler, which concatenates a database-controlled screen value directly with the application's source/ directory. RansomLook opens the resulting path without verifying that the resolved file stays within the intended directory. An authenticated administrator whose instance imports data from a malicious upstream RansomLook instance can trigger reads of arbitrary files accessible to the RansomLook process.

Critical Impact
Attackers controlling imported post data can read arbitrary files including configuration data, API credentials, and password hashes, returned Base64-encoded through the API.

Affected Products

RansomLook (open-source ransomware group tracker)
website/web/__init__.py handler prior to commit 274faccf
website/web/api/genericapi.py handler prior to commit 274faccf

Discovery Timeline

2026-08-24 - CVE-2026-78381 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78381

Vulnerability Analysis

The GroupPost.get API handler resolves the screen field of a post by joining it with the application's source/ directory and opening the resulting file. No canonical path check confirms that the resolved file remains inside source/. When the record is queried through the API, RansomLook reads the file and returns its contents Base64-encoded in the response.

The screen field is free-form text populated by two paths: the administrative post editor and tools/import_from_instance.py, which writes JSON verbatim from a remote RansomLook instance. Because the second path bypasses local admin scrutiny, a malicious upstream instance can seed traversal sequences such as ../config/generic.json into the database.

Root Cause

The root cause is missing canonicalization and containment validation on database-stored path fragments. The code trusted the screen value as a safe relative path. Purely lexical checks would still be insufficient because symbolic links inside source/ could redirect the resolved target outside the intended base directory.

Attack Vector

Exploitation requires that an operator of a RansomLook instance import data from an attacker-controlled upstream instance. The attacker does not need an account on the victim instance. Once the poisoned screen value is stored, any subsequent API retrieval of that post triggers the file read and returns the contents to the caller.

python

# Patch: canonicalize and validate the resolved path stays under source/
# Source: https://github.com/RansomLook/RansomLook/commit/274faccf65898e88ef54f35f304e0821a852a0b8
def _source_path(relative: Any) -> str | None:
    """Resolve a DB-stored path under ``source/``, or None when it escapes.

    ``screen`` is free-form text: an admin types it in the edit-post form and
    ``tools/import_from_instance.py`` writes a remote instance's JSON verbatim,
    so it must never be trusted as a path component. realpath is compared on
    both sides so a symlink cannot step outside either.
    """
    if not relative:
        return None
    base = os.path.realpath(os.path.join(str(get_homedir()), "source"))
    target = os.path.realpath(os.path.join(base, str(relative)))
    if target != base and not target.startswith(base + os.sep):
        return None
    return target

Detection Methods for CVE-2026-78381

Indicators of Compromise

API responses from GroupPost.get containing Base64-encoded payloads that decode to non-image, non-screenshot content such as JSON configuration or credential material.
Database records where a post screen field contains ../ sequences, absolute paths, or references to files outside the source/ directory.
Import events sourced from untrusted upstream RansomLook instances immediately preceding suspicious API reads.

Detection Strategies

Audit the screen column in the RansomLook post store for values containing .., leading /, or paths resolving outside source/ using os.path.realpath.
Instrument the GroupPost.get handler to log the resolved file path and flag reads whose canonical target lies outside the expected base directory.
Review web server access logs for repeated GroupPost.get API calls targeting the same post ID after an import operation.

Monitoring Recommendations

Monitor filesystem access by the RansomLook process for reads of files outside source/, particularly config/generic.json and credential stores.
Alert on outbound API responses exceeding expected size baselines for GroupPost endpoints, which may indicate exfiltration of sensitive files.
Track invocations of tools/import_from_instance.py and correlate with subsequent administrator API activity.

How to Mitigate CVE-2026-78381

Immediate Actions Required

Update RansomLook to the version that includes commit 274faccf65898e88ef54f35f304e0821a852a0b8, which introduces the _source_path containment check.
Audit existing database records and remove or normalize any screen values containing traversal sequences or absolute paths.
Rotate any credentials, API keys, or secrets stored in files reachable from the RansomLook process, assuming potential exposure.

Patch Information

The fix is available in the upstream repository via GitHub commit 274faccf. The patch adds a _source_path helper in both website/web/__init__.py and website/web/api/genericapi.py. It uses os.path.realpath() to canonicalize the base directory and the target, then rejects any target that does not remain under source/. Validation runs both on write and immediately before file reads.

Workarounds

Disable imports from untrusted upstream RansomLook instances until the patch is applied.
Restrict filesystem permissions of the RansomLook process account so it cannot read sensitive files outside source/.
Add an application-layer filter that rejects screen values containing .., null bytes, or absolute path prefixes before writes reach the database.

bash

# Apply the upstream fix and verify commit inclusion
cd /opt/RansomLook
git fetch origin
git checkout 274faccf65898e88ef54f35f304e0821a852a0b8
git log --oneline | grep 274facc

# Audit existing screen values for traversal patterns
sqlite3 ransomlook.db "SELECT id, screen FROM posts WHERE screen LIKE '%..%' OR screen LIKE '/%';"