RCE in Rrwo Catalyst::view::wkhtmltopdf
CVE-2026-16766
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-cont…
Vulnerability class: Command Injection (OS Command Injection)
Affected products
- Rrwo Catalyst::view::wkhtmltopdf — versions 0
Weakness classification (CWE)
References
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (vendor-advisory)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (release-notes)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (issue-tracking)
- af854a3a-2127-422b-91ae-364da2661108