RansomLook CVE-2026-78385

Exploitation requires an authenticated RansomLook session with privileges to create or modify an analysis - the vendor CVSS assigns PR:H, indicating high-privilege access, though the description's framing ('authenticated attacker able to create or modify an analysis') may correspond to an analyst role rather than an administrator in some deployments. The vulnerability is only reachable through the PDF export code path; if WeasyPrint is not installed (the dependency is marked optional in the commit diff) or PDF generation is administratively disabled, the attack surface does not exist. The file:// read impact is bounded by the OS-level permissions of the user account running the RansomLook process. The SSRF impact is bounded by the network reachability of the RansomLook server. External unauthenticated attackers cannot exploit this without first obtaining valid credentials. No special non-default configuration is required beyond having the PDF export feature active.

The vendor-assigned CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) accurately captures the dual-surface impact: VC:H reflects arbitrary file read on the vulnerable RansomLook host, and SC:H reflects SSRF reach into subsequent internal systems. PR:H is the most significant mitigating factor - exploitation requires an authenticated account with analysis creation or modification rights, ruling out mass unauthenticated scanning. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and any POC code suggests this is not being exploited opportunistically. The realistic threat actor is a malicious insider or an adversary who has already compromised an analyst account, not an unauthenticated remote attacker. Despite these mitigations, the business impact is disproportionately high for affected deployments: RansomLook instances typically hold sensitive threat intelligence, API keys, and credentials, and may reside in privileged network segments with access to internal services or cloud metadata endpoints (e.g., 169.254.169.254). The SSRF vector is particularly dangerous if egress filtering is not in place. One signal uncertainty: the description says 'authenticated attacker able to create or modify an analysis,' which in some deployments may correspond to PR:L (analyst role) rather than PR:H (admin) - operators should verify the role model against the vendor's CVSS assignment.

A compromised analyst account authenticates to RansomLook and edits an existing analysis, embedding a Markdown image tag referencing file:///app/website/config/config.py or http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the image source. When the analyst (or any other user) exports the analysis as a PDF, the pre-patch WeasyPrint instance fetches and embeds the referenced resource into the rendered document; the attacker downloads the PDF and extracts the embedded sensitive data - credentials, configuration secrets, or cloud IAM tokens - without any server-side detection of the exfiltration.