What’s Vulnerable › Vulnerabilities

CVE-2026-16766: Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-25 · updated 2026-10-24
• Weakness: CWE-78

Description

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

Affected products

• RRWO Catalyst::View::Wkhtmltopdf: before 0.6.1 — fixed in 0.6.1

How to fix

Upgrade to a fixed version: RRWO Catalyst::View::Wkhtmltopdf 0.6.1. Check the vendor advisory for mitigations.

References

• https://github.com/mc7244/Catalyst-View-Wkhtmltopdf/issues/6
• https://github.com/robrwo/Catalyst-View-Wkhtmltopdf/security/advisories/GHSA-42w4-jj8w-6p98
• https://metacpan.org/release/RRWO/Catalyst-View-Wkhtmltopdf-v0.6.1/changes
• https://wkhtmltopdf.org/status.html
• http://www.openwall.com/lists/oss-security/2026/07/25/4

Get alerted when CVE-2026-16766 or the next vulnerability affects your stack