CVE-2026-16766 Overview
CVE-2026-16766 is a shell command injection vulnerability in the Perl module Catalyst::View::Wkhtmltopdf affecting versions before 0.6.1. The module passes PDF render options directly to the wkhtmltopdf command without sanitization. Web applications that forward user-controlled values such as page_size, orientation, or margins allow attackers to inject arbitrary shell commands. Version 0.6.0 shipped an incomplete fix, leaving the injection path exploitable. The vulnerability maps to [CWE-78] Improper Neutralization of Special Elements used in an OS Command.
Critical Impact
Unauthenticated attackers can achieve remote code execution on the web server by supplying crafted PDF render options through vulnerable Catalyst applications.
Affected Products
- Catalyst::View::Wkhtmltopdf for Perl, all versions prior to 0.6.1
- Catalyst::View::Wkhtmltopdf version 0.6.0 (incomplete fix)
- Any Perl Catalyst web application that forwards user-controlled render options to the module
Discovery Timeline
- 2026-07-25 - CVE-2026-16766 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-16766
Vulnerability Analysis
The vulnerability resides in how Catalyst::View::Wkhtmltopdf constructs the command line used to invoke the external wkhtmltopdf binary. Render options provided by the caller are concatenated into the command string without escaping, quoting, or allow-list validation. When a Catalyst controller passes request parameters directly into the view's render options, shell metacharacters reach the operating system shell. This yields unauthenticated remote code execution in the context of the web application process.
The maintainer's initial remediation in version 0.6.0 did not fully neutralize the injection surface. Version 0.6.1 provides the complete fix. The upstream wkhtmltopdf project is no longer maintained, and the advisory recommends migrating to alternative PDF rendering solutions.
Root Cause
The root cause is unsafe construction of a shell command from untrusted input. Options such as page_size, orientation, and margins are interpolated into the command executed for wkhtmltopdf without input validation or safe process invocation. Passing arguments through a shell rather than using list-form process execution allows characters such as ;, |, `, and $() to be interpreted as shell syntax.
Attack Vector
Exploitation requires a Catalyst web application that renders PDFs using this module and forwards HTTP request parameters into render options. An attacker submits a request with a crafted value for one of the affected options. The injected shell fragment executes with the privileges of the web application process, enabling command execution, credential theft, lateral movement, and persistence. No authentication or user interaction is required when the vulnerable endpoint is publicly reachable.
No public proof-of-concept exploit is referenced in the advisory. Technical details are available in the GitHub Security Advisory, the GitHub Issue Discussion, and the Open Wall OSS Security Post.
Detection Methods for CVE-2026-16766
Indicators of Compromise
- Unexpected child processes of the Perl or Catalyst application process, particularly shells (/bin/sh, /bin/bash) or utilities like curl, wget, nc, or python
- Outbound network connections initiated by the wkhtmltopdf process or its parent web worker to unfamiliar hosts
- HTTP request logs containing shell metacharacters (;, |, `, $(, &&) in parameters mapped to PDF render options such as page_size, orientation, or margins
Detection Strategies
- Inspect application source for calls that pass request parameters into Catalyst::View::Wkhtmltopdf render options without validation
- Monitor process ancestry for wkhtmltopdf executions whose command line contains shell control characters or arguments unrelated to legitimate rendering
- Alert on web application processes spawning interactive shells or network-capable binaries following a PDF rendering endpoint hit
Monitoring Recommendations
- Enable endpoint process telemetry on servers running Perl Catalyst applications and forward events to a centralized data lake for correlation
- Log all HTTP parameters delivered to PDF export endpoints and retain them for retrospective hunting
- Baseline expected wkhtmltopdf invocations and alert on deviations in argument structure or invoking user
How to Mitigate CVE-2026-16766
Immediate Actions Required
- Upgrade Catalyst::View::Wkhtmltopdf to version 0.6.1 or later across all Catalyst deployments
- Audit application code to ensure no user-controlled input is passed to render options without strict validation
- Restrict network exposure of PDF rendering endpoints and require authentication where possible
- Plan migration away from wkhtmltopdf, which is no longer maintained, to an actively developed PDF renderer
Patch Information
The fix is available in Catalyst::View::Wkhtmltopdf version 0.6.1. Version 0.6.0 contains an incomplete fix and remains exploitable. Release details are documented in the MetaCPAN Release Changes and the GitHub Security Advisory.
Workarounds
- Enforce strict allow-lists for values passed as page_size, orientation, margins, and other render options; reject any value containing shell metacharacters
- Run the web application under a least-privileged system account with no outbound network access from the rendering process
- Disable PDF export functionality until the module is upgraded to 0.6.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
