CVE-2020-28463
Server-side Request Forgery (SSRF)
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Server-side Request Forgery (SSRF)
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
CVE-2020-28463- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P - Updated
- 2026-11-02
EUVDEUVD-2021-0223
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
EUVD-2021-0223- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mpvw-25mg-59vx
Server-side Request Forgery (SSRF) via img tags in reportlab
All versions of package reportlab at time of writing are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation)
Steps to reproduce by Karan Bamal:
- Download and install the latest package of reportlab
- Go to demos -> odyssey -> dodyssey
- In the text file odyssey.txt that needs to be converted to pdf inject
<img src="http://127.0.0.1:5000" valign="top"/> - Create a nc listener
nc -lp 5000 - Run python3 dodyssey.py
- You will get a hit on your nc showing we have successfully proceded to send a server side request
- dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
GHSA-mpvw-25mg-59vx- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
CVE-2020-28463- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
CVE-2020-28463- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-28463
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
DEBIAN-CVE-2020-28463- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-mpvw-25mg-59vx
Server-side Request Forgery (SSRF) via img tags in reportlab
All versions of package reportlab at time of writing are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation)
Steps to reproduce by Karan Bamal:
- Download and install the latest package of reportlab
- Go to demos -> odyssey -> dodyssey
- In the text file odyssey.txt that needs to be converted to pdf inject
<img src="http://127.0.0.1:5000" valign="top"/> - Create a nc listener
nc -lp 5000 - Run python3 dodyssey.py
- You will get a hit on your nc showing we have successfully proceded to send a server side request
- dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
GHSA-mpvw-25mg-59vx- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVOESA-2022-1887
python-reportlab security update
The ReportLab Toolkit. An Open Source Python library for generating PDFs and graphics.
Security Fix(es):
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF(CVE-2020-28463)
- Record
OESA-2022-1887- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-28463
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
UBUNTU-CVE-2020-28463- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2021-0521 No score
Updated python-reportlab packages fix security vulnerability
Server-side Request Forgery (SSRF)
- Record
MGASA-2021-0521- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1147-1 No score
Security update for python-reportlab
This update for python-reportlab fixes the following issues:
- CVE-2020-28463: Fixed Server-side Request Forgery via img tags (bsc#1182503).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:1147-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2641-1 No score
Security update for python-reportlab
This update for python-reportlab fixes the following issues:
- CVE-2020-28463: Fixed Server-side Request Forgery via img tags (bsc#1182503).
- Record
openSUSE-SU-2021:2641-1- Updated
- 2026-11-02
OSVPYSEC-2021-146 No score
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Record
PYSEC-2021-146- Updated
- 2026-11-02
OSVSUSE-SU-2021:3209-1 No score
Security update for python-reportlab
This update for python-reportlab fixes the following issues:
- CVE-2020-28463: Fixed Server-side Request Forgery via img tags (bsc#1182503).
- Add missing import in CVE-2020-28463 fix (bsc#1190110).
- Record
SUSE-SU-2021:3209-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
reportlabPyPI |
before 3.5.55 | 3.5.55 |
python-reportlabDebian:12 |
before 3.5.55-1 | 3.5.55-1 |
python-reportlabDebian:13 |
before 3.5.55-1 | 3.5.55-1 |
python-reportlabDebian:14 |
before 3.5.55-1 | 3.5.55-1 |
python-reportlabDebian:10 From an advisory covering 2 CVEs |
before 3.5.13-1+deb10u2, plus listed versions 3.5.13-13.5.13-1+deb10u1 |
3.5.13-1+deb10u2 |
reportlabPyPI |
before 3.5.55, plus listed versions 2.02.32.42.52.6 Show 43 moreShow less2.73.03.1.443.1.83.2.03.3.03.4.03.5.03.5.13.5.103.5.113.5.123.5.133.5.163.5.173.5.183.5.193.5.23.5.203.5.213.5.233.5.263.5.283.5.313.5.323.5.343.5.43.5.423.5.443.5.453.5.463.5.473.5.483.5.493.5.53.5.503.5.513.5.523.5.533.5.543.5.63.5.83.5.9 |
3.5.55 |
python-reportlabMageia:8 |
before 3.6.2-1.mga8 | 3.6.2-1.mga8 |
python-reportlabopenEuler:20.03-LTS-SP1 |
before 3.6.10-1.oe1 | 3.6.10-1.oe1 |
python-reportlabopenEuler:20.03-LTS-SP3 |
before 3.6.10-1.oe1 | 3.6.10-1.oe1 |
python-reportlabopenEuler:22.03-LTS |
before 3.6.10-1.oe2203 | 3.6.10-1.oe2203 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-reportlabSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 2.7-3.8.1 | 2.7-3.8.1 |
python-reportlabUbuntu:16.04:LTS |
All versions, plus listed versions 3.2.0-1build13.2.0-1build23.3.0-13.3.0-1ubuntu0.1 |
None known |
python-reportlabUbuntu:18.04:LTS |
All versions, plus listed versions 3.4.0-3build13.4.0-3ubuntu0.1 |
None known |
python-reportlabUbuntu:20.04:LTS |
All versions, plus listed versions 3.5.23-13.5.28-13.5.31-13.5.31-1.13.5.31-1.1ubuntu1 Show 4 moreShow less3.5.34-13.5.34-1build13.5.34-1ubuntu13.5.34-1ubuntu1.1 |
None known |
python-reportlabopenSUSE:Leap 15.2 |
before 3.4.0-lp152.5.3.1 | 3.4.0-lp152.5.3.1 |
python-reportlabopenSUSE:Leap 15.3 |
before 3.4.0-3.6.1 | 3.4.0-3.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-28463 is a medium vulnerability (CVSS 6.5) in Reportlab, published February 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in reportlab 3.5.55.
References
snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145
reportlab.com/docs/reportlab-userguide.pdf
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMUJA5GZTPQ5WRYUCCK2GEZM4W43N7HH
lists.debian.org/debian-lts-announce/2023/09/msg00037.html
nvd.nist.gov/vuln/detail/CVE-2020-28463
Show 21 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1930417
hg.reportlab.com/hg-public/reportlab/rev/7f2231703dc7
github.com/advisories/GHSA-mpvw-25mg-59vx
security-tracker.debian.org/tracker/CVE-2020-28463
advisories.mageia.org/MGASA-2021-0521.html
bugs.mageia.org/show_bug.cgi?id=29592
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1887
suse.com/support/update/announcement/2021/suse-su-20213209-1
bugzilla.suse.com/1182503
ubuntu.com/security/CVE-2020-28463
cve.org/CVERecord?id=CVE-2020-28463
lists.opensuse.org/archives/list/[email protected]/thread/GKQHRG3VVE7T4B4XL3YGBVUD72DQRRHC