CVE-2026-78378

Name of the Vulnerable Software and Affected Versions Ransomlook (affected versions not specified)

Description Insufficient neutralization of user-controlled input allows for Redis glob pattern injection when values are incorporated into Redis SCAN MATCH patterns. An unauthenticated attacker can use glob metacharacters such as *, ?, [, or ] to broaden the scan operation. This can lead to the unauthorized enumeration of health information, mirror slugs, and uptime series for all groups and markets, including private entities. The issue affects the /api/health/<name> and /api/crypto/chain/<chain> endpoints, as well as the delete manual torrent() function. In the case of delete manual torrent(), a crafted infohash could potentially match torrent-health keys belonging to other torrents.

Recommendations Apply the available patch to remove the unsafe fallback in the health endpoint and implement glob escaping for user-controlled values used in Redis SCAN MATCH expressions. As a temporary mitigation, restrict access to the /api/health/<name> and /api/crypto/chain/<chain> endpoints and avoid passing untrusted input to the delete manual torrent() function.