324 matches found
CVE-2023-33733
CVE-2023-33733 Reportlab Library - Remote Code Execution...
CVE-2023-33733
CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup pip3 install -r requirements.txt Run python3 app.py Attacker Connect to server Connect to server ...
CVE-2023-33733
CODE INJECTION VULNERABILITY IN REPORTLAB PYTHON LIBRARY tl;dr This write-up details how an RCE in Reportlab - was found and exploited. Due to the prevalence of Reportlab in HTML to PDF processing, this vulnerability may be reachable in many applications that process PDF files, making this an...
Lab_Reportlab
LAB Reportlab This lab was set up to test CVE-2023-33733. Setup and Run Setup pip3 install -r requirements.txt Run python3 app.py...
Astra Linux – Vulnerability in python-reportlab
All versions of the reportlab package are vulnerable to Server-side Request Forgery SSRF via img tags. To reduce this risk, use trustedSchemes and trustedHosts see Reportlab’s documentation. Steps to reproduce by Karan Bamal: 1. Download and install the latest version of the reportlab package. 2...
python313-reportlab-4.5.1-1.2 on GA media (moderate)
python313-reportlab-4.5.1-1.2 on GA media Announcement ID: openSUSE-SU-2026:12037-1 Rating: moderate Cross-References: CVE-2019-17626 CVSS scores: CVE-2019-17626 SUSE : 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L Affected Products: openSUSE Tumbleweed An update that solves one vulnerability...
CVE-2026-108850
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...
CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...
CVE-2026-108850
The Company Research Agent software (versions through 2.2.0 ) is vulnerable to a server-side request forgery (SSRF) via the /generate-pdf endpoint. The root cause is the injection of unescaped ReportLab paragraph markup into the report_content parameter. Unauthenticated attackers can embed inline...
EUVD-2026-97001
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...
CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...
CVE-2026-108850: Server-Side Request Forgery (SSRF)
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...
PT-2026-105746
These are all security issues fixed in the python313-reportlab-4.5.1-1.2 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:12037-1 python313-reportlab-4.5.1-1.2 on GA media
These are all security issues fixed in the python313-reportlab-4.5.1-1.2 package on the GA media of openSUSE Tumbleweed...
Rocky Linux 8.8 [CIQ] Security Update: python3-reportlab / python3-reportlab-debuginfo (ciqsa-2026_0354)
The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260354 advisory. This advisory aggregates security fixes for the python-reportlab SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2019-19450. Tenable has extracted the preceding...
Rocky Linux 8.6 [CIQ] Security Update: python3-reportlab / python3-reportlab-debuginfo (ciqsa-2026_0247)
The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260247 advisory. This advisory aggregates security fixes for the python-reportlab SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2019-19450. Tenable has extracted the preceding...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-reportlab (UTSA-2023-002178)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002178 advisory. Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. Tenable has extracted the preceding description block directly...
Astra Linux – Vulnerability in python-reportlab
The paraparser module in ReportLab before version 3.5.31 allows for remote code execution. This occurs because the startunichar function in paraparser.py evaluates untrusted user input as a Unicode character in a crafted XML document. The input includes the string “'code='” followed by arbitrary...
