CVE-2026-78385

Name of the Vulnerable Software and Affected Versions RansomLook (affected versions not specified)

Description Insufficient resource validation in the analysis PDF generation functionality allows an authenticated attacker to embed crafted resource references using schemes such as file:// or http://. Because analysis documents are converted from Markdown to HTML and passed to WeasyPrint for rendering using a default URL fetcher, these references are resolved without restrictions using the server's privileges. This can lead to arbitrary local file access, exposing sensitive configuration and credentials, or Server-Side Request Forgery (SSRF), where the server initiates unauthorized requests to localhost, internal network services, or external systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.