Executive brief
A vulnerability in the Catalyst-View-Wkhtmltopdf Perl module allows attackers to execute unauthorized commands on the server. This module is used by web applications to convert web pages into PDF documents. If an application allows users to customize PDF settings like page size or margins, an attacker can inject malicious code that takes control of the web server, potentially leading to data theft or full system compromise.
Technical details
The Catalyst::View::Wkhtmltopdf::render() function constructs shell commands using plain string interpolation and executes them via backticks without proper quoting or escaping. Specifically, seven documented render options (page_size, orientation, page_width, page_height, and various margins) are read from the request-scoped stash and interpolated verbatim into the command string. An attacker can provide malicious values for these options (e.g., 'a4; id #') to achieve Remote Code Execution (RCE) as the web-server user. While version 0.6.0 attempted to address this, the fix was incomplete; version 0.6.1 provides the full patch. Notably, the underlying wkhtmltopdf project is end-of-life.
Affected products
- Perl CPAN Catalyst-View-Wkhtmltopdf < 0.6.1
Timeline
- 2026-07-24: advisory: GitHub Security Advisory GHSA-42w4-jj8w-6p98 published
- 2026-07-25: disclosed: CVE-2026-16766 published
- 2026-07-24: patched: Version 0.6.1 released to address the vulnerability