CVE-2026-16766

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16766

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16766.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16766

Aliases

GHSA-42w4-jj8w-6p98

Published

2026-07-25T08:12:42.260Z

Modified

2026-07-28T04:02:32.737827047Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options

Details

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.

Options are passed directly to the wkhtmltopdf command without sanitization.

Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection.

Version 0.6.0 was released with an incomplete fix for this issue.

Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

Database specific

{
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16766.json",
    "cwe_ids": [
        "CWE-78"
    ]
}

References

Affected packages

Git / github.com/robrwo/catalyst-view-wkhtmltopdf

Affected ranges

Type

GIT

Repo

https://github.com/robrwo/catalyst-view-wkhtmltopdf

Events

Introduced

Fixed

74d68f9f9923b516e1d0cbc907a2c61550f74891

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.6.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16766.json"