Vulnerability Description
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/mc7244/Catalyst-View-Wkhtmltopdf/issues/6
- https://github.com/robrwo/Catalyst-View-Wkhtmltopdf/security/advisories/GHSA-42w
- https://metacpan.org/release/RRWO/Catalyst-View-Wkhtmltopdf-v0.6.1/changes
- https://wkhtmltopdf.org/status.html
- http://www.openwall.com/lists/oss-security/2026/07/25/4
FAQ
What is CVE-2026-16766?
CVE-2026-16766 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. An...
How severe is CVE-2026-16766?
CVE-2026-16766 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-16766?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.