CVE-2020-28463: Server-side Request Forgery (SSRF) in reportlab
Summary
CVE-2020-28463: Server-side Request Forgery (SSRF) via img tags in reportlab. Affects reportlab versions < 3.5.55. Fixed in 3.5.55. How to fix ↓
Also tracked for
- python-reportlab · Debian:11
The same CVE-2020-28463 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Reportlab is a Python library used for creating PDF documents. It provides a wide range of features and functionalities for generating dynamic PDFs. However, all versions of the reportlab package are vulnerable to Server-side Request Forgery (SSRF) attacks through img tags. This vulnerability allows an attacker to manipulate the server to make requests to arbitrary URLs, potentially leading to unauthorized access or data leakage.
Vulnerability Detail
The SSRF vulnerability in reportlab arises from the lack of proper validation and sanitization of user-supplied input in the img tags. By injecting a malicious URL in the img tag, an attacker can trick the server into making requests to internal resources or external systems. This can result in various security risks, including information disclosure, remote code execution, or further exploitation of internal systems.
How To Fix
Latest published version: 5.1.0 as of 23 Oct 2026
pip install --upgrade "reportlab==5.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.55
This is the first release that contains the fix.
pip install --upgrade "reportlab==3.5.55"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the reportlab package is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the img tag inputs. This can be done by implementing a custom validation function that checks the URL against a whitelist of trusted schemes and hosts. Additionally, it is crucial to ensure that the application runs in a secure environment with restricted network access to minimize the impact of potential SSRF attacks.
Conclusion
The SSRF vulnerability in the reportlab package exposes applications to potential security risks, including unauthorized access and data leakage. It is crucial to upgrade to the latest version of the package (3.5.55 or later) to mitigate this vulnerability. Implementing proper input validation and sanitization, as well as restricting network access, can further enhance the security posture of the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for reportlab →
FAQ
Server-side Request Forgery (SSRF) is a vulnerability that allows an attacker to manipulate a server into making requests to arbitrary URLs. By exploiting this vulnerability, an attacker can potentially access internal resources, perform unauthorized actions, or extract sensitive information.
SSRF attacks can lead to various security risks, including information disclosure, remote code execution, and further exploitation of internal systems. Attackers can use SSRF to bypass network restrictions, access internal APIs, or perform actions on behalf of the server.
To mitigate the risk of SSRF attacks, it is essential to implement proper input validation and sanitization. Additionally, restricting network access for the server, using a whitelist of trusted schemes and hosts, and keeping software up to date with security patches can help prevent SSRF vulnerabilities.
Yes, upgrading to version 3.5.55 or later of the reportlab package includes fixes for the SSRF vulnerability. It is recommended to always use the latest version of the package to ensure the application is protected against known security issues.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for reportlab.
