Insufficient Resource Validation in RansomLook PDF Generation

CVE-2026-78385

What is CVE-2026-78385?

The RansomLook product features a significant vulnerability in its PDF generation process due to inadequate resource validation. When converting analysis documents from Markdown to HTML, the tool utilizes WeasyPrint for rendering the PDF. This process previously employed a default URL fetcher in WeasyPrint that allowed unrestricted resource references, including potentially malicious schemes such as file:// or http://. An authenticated attacker could exploit this weakness by embedding crafted resource references into an analysis. When rendered, WeasyPrint would process these references with the server's privileges, leading to the potential exposure of sensitive files and local data. Moreover, network URLs could manipulate the server into making requests to internal services or external systems, thereby resulting in server-side request forgery (SSRF). A patch has been implemented to enhance security by introducing a dedicated URL fetcher that restricts accessible resources strictly to safe types and locations.

References