CVE-2026-108850 in Company Research Agent
Summary
by MITRE • 10/11/2026
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in report_content to make the server fetch internal or external hosts, leaking image responses in returned PDFs and probing reachability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within Company Research Agent versions up to 2.2.0 represents a critical Server-Side Request Forgery (SSRF) flaw rooted in insufficient input validation during the generation of Portable Document Format files. The core technical failure occurs at the /generate-pdf endpoint, where user-supplied content is processed by ReportLab, a popular Python library for creating PDF documents. Specifically, the application fails to properly sanitize or escape paragraph markup provided within the report_content parameter. This lack of sanitization allows an unauthenticated attacker to inject arbitrary HTML-like elements, particularly inline img tags, directly into the document generation pipeline. Because ReportLeg processes these embedded images by fetching their source URLs from remote servers before embedding them into the final PDF output, the server effectively acts as a proxy for any URL specified in the malicious payload.
This architectural oversight enables attackers to force the application server to initiate outbound HTTP or HTTPS requests to arbitrary destinations. The operational impact is severe, as it allows adversaries to probe internal network infrastructure that may not be directly accessible from the public internet. By crafting payloads with img src attributes pointing to internal IP addresses and specific ports, an attacker can determine which services are running on those hosts based on whether the image fetch succeeds or fails. Furthermore, if the targeted service returns data in a format compatible with images, such as certain binary responses or base64-encoded content that ReportLab might attempt to parse, sensitive information from internal systems could be exfiltrated back into the generated PDF file and subsequently downloaded by the attacker. This transforms the vulnerability from a simple denial-of-service vector into a powerful tool for network reconnaissance and data theft.
From a classification perspective, this flaw aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes weaknesses where an application retrieves resources specified by user input without sufficient validation of the destination address. Additionally, the exploitation technique maps to MITRE ATT&CK tactic T1572 Protocol Tunneling and specifically Technique T1046 Network Service Discovery, as attackers use the server's outbound capabilities to map out internal network services. The vulnerability is particularly dangerous because it requires no authentication, expanding the attack surface to include any user who can access the PDF generation feature or potentially automated systems that trigger reports.
Mitigation strategies must focus on strict input validation and secure configuration of the underlying document generation library. Developers should implement a whitelist approach for allowed URLs in image sources, restricting them to known internal domains if external images are not strictly necessary, or completely disabling remote resource fetching within ReportLab by configuring it to ignore external links when generating PDFs from trusted content. If external resources are required, implementing an allowlist of approved domains and ensuring that all user-supplied input is escaped before being passed to the rendering engine will prevent injection attacks. Additionally, deploying a web application firewall with rules capable of detecting SSRF patterns in HTTP requests can provide an additional layer of defense by blocking outbound connections from the application server to private IP ranges or suspicious external endpoints.