CVE-2026-108850: Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent to make the server fetch internal or external hosts, leaking image responses in returned PDFs and probing reachability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote attackers can exploit it if they can reach the /generate-pdf endpoint. No privileges or user interaction are required.
What does an attacker need to send?
The attacker needs to supply report_content containing unescaped ReportLab paragraph markup, such as an inline img element. This causes the server to make an outbound request to an attacker-selected internal or external host.
What can an attacker learn or access through the vulnerable endpoint?
The issue can be used to probe whether internal or external hosts are reachable from the server. Image responses fetched by the server may be included in the returned PDF, potentially disclosing their contents.
Are default deployments affected?
The provided information identifies affected versions through 2.2.0, but does not state whether /generate-pdf is enabled or reachable in a default deployment.
How can I determine whether an instance is affected?
Check whether the deployment uses Company Research Agent version 2.2.0 or earlier and exposes the /generate-pdf endpoint. The vulnerable behavior occurs when report_content accepts unescaped ReportLab paragraph markup that can include inline img elements.