CVE-2026-16766: Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.
Options are passed directly to the wkhtmltopdf command without sanitization.
Any web application that passes user-controlled options such as the pagesize, orientation or margins without validation allows shell command injection.
Version 0.6.0 was released with an incomplete fix for this issue.
Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Catalyst::View::Wkhtmltopdfto a version that resolves this vulnerability.Fixed in 0.6.1 - Upgrade
Upgrade
Catalyst::View::Wkhtmltopdfto a version that resolves this vulnerability.Fixed in 0.6.1 or later
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16766?
CVE-2026-16766 has a critical severity rating of 9.8 according to the CVSS 3.1 scoring system.
What vulnerability does CVE-2026-16766 describe?
CVE-2026-16766 describes a shell command injection vulnerability in Catalyst::View::Wkhtmltopdf versions prior to 0.6.1 for Perl.
How can I fix CVE-2026-16766?
To fix CVE-2026-16766, upgrade Catalyst::View::Wkhtmltopdf to version 0.6.1 or later.
What are the potential impacts of CVE-2026-16766?
Exploitation of CVE-2026-16766 could allow an attacker to execute arbitrary shell commands on the server.
Which versions are affected by CVE-2026-16766?
CVE-2026-16766 affects all versions of Catalyst::View::Wkhtmltopdf prior to 0.6.1.