CVE-2026-16766

Deferred Deferred - Pending Action

Remote Code Execution in Catalyst::View::Wkhtmltopdf

Publication date: 2026-07-25

Last updated on: 2026-08-13

Assigner: CPANSec

Description

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-16766

EUVD

EUVD-2026-48767

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-16766 is a command injection vulnerability in the Perl package Catalyst-View-Wkhtmltopdf affecting versions before 0.6.1. The issue occurs in the render() method where user-controlled options like page_size or orientation are directly passed to the wkhtmltopdf command without sanitization. This allows attackers to inject shell commands that execute with the privileges of the web server user.

Detection Guidance

Check if your system uses Catalyst::View::Wkhtmltopdf versions before 0.6.1. Inspect Perl applications for user-controlled options passed to wkhtmltopdf without sanitization. Look for command injection attempts in logs, such as unusual parameters like page_size set to values containing semicolons or shell commands.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the server running the vulnerable application. If user input influences PDF rendering options, an attacker could run system commands, potentially stealing data, installing malware, or taking control of the server. The impact depends on the server's permissions and the commands executed.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade to the latest version if available, though version 0.6.0 had an incomplete fix. Migrate to alternative PDF rendering solutions since wkhtmltopdf is no longer maintained. Ensure user-controlled options are strictly validated and sanitized before passing them to wkhtmltopdf.

Hi! I’m here to help you understand CVE-2026-16766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70