CVE-2020-28463

All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF

• CWE-918

• https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMUJA5GZTPQ5WRYUCCK2GEZM4W43N7HH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZQSFCID67K6BTC655EQY6MNOF35QI44/
• https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145Exploit, Release Notes, Third Party Advisory
• https://www.reportlab.com/docs/reportlab-userguide.pdfProduct, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMUJA5GZTPQ5WRYUCCK2GEZM4W43N7HH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZQSFCID67K6BTC655EQY6MNOF35QI44/
• https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145Exploit, Release Notes, Third Party Advisory
• https://www.reportlab.com/docs/reportlab-userguide.pdfProduct, Vendor Advisory

Published

Feb 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28458All versions of package datatables.net are vulnerable to Pro…7.3
• CVE-2020-28459This affects all versions of package markdown-it-decorate. A…6.1
• CVE-2020-2846Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28460This affects the package multi-ini before 2.1.2. It is possi…8.1
• CVE-2020-28461This affects the package js-ini before 1.3.0. If an attacker…9.8
• CVE-2020-28462This affects all versions of package ion-parser. If an attac…9.8
• CVE-2020-28464This affects the package djv before 2.1.4. By controlling th…9.8
• CVE-2020-28466This affects all versions of package github.com/nats-io/nats…7.5
• CVE-2020-28468This affects the package pwntools before 4.3.1. The shellcra…9.8
• CVE-2020-28469This affects the package glob-parent before 5.1.2. The enclo…7.5
• CVE-2020-2847Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28470This affects the package @scullyio/scully before 1.0.9. The …6.1