Read the docs
TI-2026-13955 Aliases CVE-2026-16766

OS command injection in RRWO Catalyst::View::Wkhtmltopdf

Priority MEDIUM 54CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.

Summary

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02574 85th percentileScored 2026-11-07
Fix Fixed Catalyst::View::Wkhtmltopdf (RRWO): 0.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RRWOCatalyst::View::Wkhtmltopdfbefore 0.6.10.6.1Patch availableCNA
  • Catalyst::View::Wkhtmltopdf VendorRRWO Affected before 0.6.1 Fixed in 0.6.1 Patch available CNA

Remediation

  • Fix · CNA Catalyst::View::Wkhtmltopdf (RRWO) Fixed in 0.6.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16766

References

Advisory 1

Other 3

  • TI-2026-14395 Server-side request forgery in RRWO Plack::App::Prerender CVSS 3.1CRITICAL 9.1
  • TI-2026-34943 Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts CVSS 3.1CRITICAL 9.1
  • TI-2026-34345 Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections CVSS 3.1HIGH 8.2
  • TI-2026-15909 Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set… CVSS 3.1HIGH 7.5
  • TI-2026-36790 Uncontrolled recursion in RRWO Net::CIDR::Set CVSS 3.1HIGH 7.5
  • TI-2026-34944 Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences