CVE-2026-78381

Name of the Vulnerable Software and Affected Versions RansomLook (affected versions not specified)

Description A path traversal issue exists in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the screen value from the database directly with the application's source/ directory and opens the path without verifying if the resolved file remains within the intended directory. Since the screen field is free-form and can be populated via the administrative post editor or imported from a remote instance, a malicious upstream instance can provide traversal sequences like ../config/generic.json. When the post is retrieved, the application reads the attacker-controlled path and returns the file contents Base64-encoded in the API response. This allows an administrator controlling imported post data to read arbitrary files accessible to the process, potentially exposing configuration data, API credentials, password hashes, or other secrets. The attack does not require the malicious upstream instance to have an account on the affected system.

Recommendations Resolve screen paths using os.path.realpath() and verify that the resolved path remains beneath the application's source/ directory. Perform validation both when values are written and immediately before files are read. Use canonical paths to prevent traversal through symbolic links.