PatchSiren cyber security CVE debrief

CVE-2026-16766 RRWO CVE debrief

CVE-2026-16766 is a vulnerability in Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl. The vulnerability allows shell command injection via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

Vendor: RRWO
Product: Catalyst::View::Wkhtmltopdf
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-25
Original CVE updated: 2026-08-13
Advisory published: 2026-07-25
Advisory updated: 2026-08-13

Who should care

Users of Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl should be aware of this vulnerability and take steps to mitigate it. This includes validating user-controlled options and migrating to alternative solutions.

Technical summary

The vulnerability exists in Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl. The wkhtmltopdf command is used to generate PDFs, and user-controlled options are passed directly to this command without sanitization. This allows for shell command injection, potentially leading to remote code execution. The vulnerability is particularly concerning because the wkhtmltopdf project is no longer being developed, leaving users without a clear path for remediation.

Defensive priority

High

Recommended defensive actions

Validate and sanitize user-controlled options passed to the wkhtmltopdf command
Migrate to alternative solutions that are actively maintained and support secure PDF generation
Monitor for and respond to potential exploitation attempts
Inventory affected systems and prioritize patching or migration efforts
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-25T09:16:32.000Z and has not been modified since then. The NVD entry is currently Received. Multiple sources, including GitHub and Metacpan, provide additional information about the vulnerability and potential mitigations.

Sources and references

Verified primary and authoritative sources

CVE-2026-16766 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-16766

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-16766 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-16766

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/mc7244/Catalyst-View-Wkhtmltopdf/issues/6

9b29abf9-4ab0-4765-b253-1875cd9b441e
Source reference
Unverified legacy reference

URL: https://github.com/robrwo/Catalyst-View-Wkhtmltopdf/security/advisories/GHSA-42w4-jj8w-6p98

9b29abf9-4ab0-4765-b253-1875cd9b441e
Source reference
Unverified legacy reference

URL: https://metacpan.org/release/RRWO/Catalyst-View-Wkhtmltopdf-v0.6.1/changes

9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.