CVE-2026-78385: RansomLook PDF Generator SSRF Vulnerability

CVE-2026-78385 Overview

CVE-2026-78385 is a server-side request forgery (SSRF) and local file access vulnerability in RansomLook, an open-source ransomware intelligence platform. The flaw resides in the analysis PDF generation feature, which converts Markdown to HTML and passes the output to WeasyPrint for rendering. WeasyPrint uses its default URL fetcher, which resolves arbitrary resource references without restriction. An authenticated attacker who can create or modify an analysis can embed file:// or http:// references. When the PDF renders, WeasyPrint executes those requests using the RansomLook server's privileges and network access.

Critical Impact
Authenticated attackers can read local files, reach internal network services, and bypass network-level access restrictions through the RansomLook server.

Affected Products

RansomLook (versions prior to commit 34dc028)
Deployments using RansomLook's analysis PDF generation feature
Instances relying on WeasyPrint's default URL fetcher

Discovery Timeline

2026-08-24 - CVE-2026-78385 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78385

Vulnerability Analysis

RansomLook renders analyst-authored analyses as PDF documents. The workflow parses Markdown, produces HTML, and hands the HTML to WeasyPrint. WeasyPrint fetches embedded resources such as images, stylesheets, and fonts using its default fetcher. That fetcher accepts any URL scheme, including file://, http://, and https://. This behavior classifies the flaw as SSRF under [CWE-918].

The attacker requires authentication but not administrative privileges. Any account with permission to create or modify an analysis can inject a crafted resource reference. The malicious reference triggers when a user or automation renders the PDF. WeasyPrint issues the request from the RansomLook server process, inheriting its filesystem permissions and internal network reachability.

Root Cause

The root cause is missing resource validation in the PDF rendering pipeline. WeasyPrint was invoked without a custom url_fetcher argument, so it applied its permissive default. HTML produced from user-controlled Markdown was trusted as safe for resource resolution. No allowlist restricted resource schemes, hostnames, or filesystem paths before dispatch.

Attack Vector

An authenticated attacker embeds a resource reference inside analysis Markdown. Example payloads include an <img> tag pointing to file:///etc/passwd, an http://169.254.169.254/ reference to reach a cloud metadata service, or an http://127.0.0.1: URL targeting internal admin endpoints. When PDF generation runs, WeasyPrint fetches each reference. file:// URLs expose any file readable by the RansomLook process, including configuration files, API tokens, and credentials. HTTP URLs let the attacker probe internal services, bypass firewall rules that trust the server's IP, and exfiltrate response data through the rendered PDF.

Refer to the RansomLook patch commit for the fix implementation details.

Detection Methods for CVE-2026-78385

Indicators of Compromise

Analysis records containing file://, http://, or https:// references outside the analysis asset directory
Outbound HTTP requests from the RansomLook server to internal IP ranges, cloud metadata endpoints, or localhost correlated with PDF generation events
Access to sensitive local files by the RansomLook service account during rendering
Unexpected DNS lookups originating from the RansomLook host tied to analysis rendering

Detection Strategies

Audit stored analysis content for resource references that use disallowed schemes or point outside the permitted asset directory
Correlate application logs for PDF generation actions with process-level network and filesystem telemetry
Alert on any read attempts by the RansomLook process against paths such as /etc/, ~/.ssh/, or application secrets
Monitor for HTTP requests to 169.254.169.254, 127.0.0.1, and RFC1918 addresses from the server

Monitoring Recommendations

Capture and retain WeasyPrint fetcher activity, including source URL and requester
Log analysis create and update events with the authenticated user and diff of resource references
Baseline outbound connections from the RansomLook host and alert on deviations during rendering

How to Mitigate CVE-2026-78385

Immediate Actions Required

Update RansomLook to a version that includes commit 34dc028 or later
Review existing analyses for embedded external references and remove untrusted entries
Rotate credentials, API tokens, and secrets accessible from the RansomLook host if compromise is suspected
Restrict analysis authoring privileges to trusted accounts and enforce multi-factor authentication

Patch Information

The upstream fix introduces a dedicated WeasyPrint url_fetcher that only permits data: resources, the RansomLook report logo, and files inside the analysis asset directory. All other network URLs and filesystem paths are rejected. Apply the patch from the RansomLook commit 34dc028.

Workarounds

Disable the PDF generation feature until the patched version is deployed
Run the RansomLook service under a low-privilege account with no read access to sensitive files
Apply egress firewall rules that block the RansomLook host from reaching internal networks, localhost, and cloud metadata endpoints
Sanitize analysis Markdown at submission to strip resource references using non-data: schemes

bash

# Example egress restriction using iptables on the RansomLook host
iptables -A OUTPUT -m owner --uid-owner ransomlook -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner ransomlook -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner ransomlook -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner ransomlook -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner ransomlook -d 192.168.0.0/16 -j REJECT