RCE in Rrwo Catalyst::view::wkhtmltopdf
CVE-2026-16766
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.014 (71.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Rrwo Catalyst::view::wkhtmltopdf — versions 0
Weakness classification (CWE)
References
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (vendor-advisory)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (release-notes)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (issue-tracking)
- af854a3a-2127-422b-91ae-364da2661108
- 9b29abf9-4ab0-4765-b253-1875cd9b441e
Frequently asked questions
- What is CVE-2026-16766?
- CVE-2026-16766 is a critical-severity vulnerability in Rrwo Catalyst::view::wkhtmltopdf, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-07-25.
- How severe is CVE-2026-16766?
- Critical severity. CVSS v3 base score is 9.8 out of 10.