RansomLook CVE-2026-78381

The primary attack path requires the victim RansomLook instance to import post data from an attacker-controlled upstream instance via the tools/import_from_instance.py federation mechanism; the upstream does not require any account on the victim instance. The secondary attack path requires the attacker to hold admin-level credentials on the victim instance to manually set a malicious screen value via the post editor. Exploitation is further limited to: RansomLook versions 0 through 2.0.0; files accessible to the OS user running the RansomLook process; and deployments where the GroupPost.get API endpoint is reachable by the attacker after the poisoned post is stored. The federation import path is not a default-on feature - it must be deliberately invoked by an operator - which reduces exposure compared to a fully passive attack surface, but is commonly used in community threat-intelligence sharing deployments.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.2) accurately reflects the primary attack surface: network-accessible, low complexity, but requiring high privileges in the conventional single-instance sense. The PR:H rating deserves careful interpretation - direct exploitation via the admin post editor requires administrative credentials on the victim instance, but the federation import path allows a malicious upstream instance to write traversal values into the victim's database without any account on the victim, lowering the effective barrier for federated deployments. SC:H (subsequent system high confidentiality impact) is well-justified because arbitrary file read can surface credentials, private keys, and secrets held by other co-located services accessible to the RansomLook OS user. No EPSS data was provided; the vulnerability is absent from CISA KEV; no public exploit code has been identified. Real-world risk is highest for multi-instance RansomLook deployments that consume data from external or community-operated upstream nodes, where the PR:H constraint is effectively weakened by the federated trust model.

An attacker operates a RansomLook instance and crafts a group post with the screen field set to a path traversal string such as ../../../../home/ransomlook/config/generic.json. When the victim's RansomLook operator runs tools/import_from_instance.py against the attacker's upstream, the malicious screen value is written verbatim into the victim's database. Any subsequent call to the GroupPost.get API endpoint for that post causes the victim's server to resolve the attacker-controlled path, read the target file, and return its contents Base64-encoded in the JSON response - exposing configuration secrets, API keys, or password hashes to the attacker.