CVE-2026-16770: PDF::WebKit Privilege Escalation Flaw

CVE-2026-16770 Overview

CVE-2026-16770 is an argument injection vulnerability [CWE-88] affecting PDF::WebKit versions through 1.2 for Perl. The module converts HTML documents to PDF using wkhtmltopdf as the rendering backend. Attackers who control the HTML source can inject arbitrary command-line options into the renderer through crafted <meta> tags. The injected options can enable local file access, override application-defined settings, or write output to attacker-chosen paths. This affects any application that renders untrusted HTML through PDF::WebKit.

Critical Impact
Untrusted HTML content can override renderer options set by the calling application, reaching switches such as --enable-local-file-access and --cookie-jar to exfiltrate local files into the resulting PDF.

Affected Products

PDF::WebKit for Perl, versions through 1.2
Applications that pass untrusted HTML strings or files to PDF::WebKit
Deployments using wkhtmltopdf as the rendering backend

Discovery Timeline

2026-08-13 - CVE-2026-16770 published to the National Vulnerability Database
2026-08-13 - Public disclosure via OpenWall OSS Security list
2026-08-13 - Patch published on MetaCPAN
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-16770

Vulnerability Analysis

The vulnerability resides in the _pdf_webkit_meta_tags routine used by the PDF::WebKit constructor. When the source is an HTML string or file, the constructor scans the document head for every <meta name="pdf-webkit-KEY" content="VALUE"> element. Each match is converted into a wkhtmltopdf command-line option. The KEY is normalized to match --[a-z0-9-]+ but is not validated against an allow list of safe options. The VALUE is passed through unchanged as the argument that follows the option. A VALUE of yes causes the option to be emitted as a bare flag.

Because the BUILD phase merges these meta-derived options last, they override both the module defaults and any options passed to new. The renderer executes with an argument list rather than through a shell, so this is argument injection rather than shell injection. The classification maps to [CWE-88] Improper Neutralization of Argument Delimiters in a Command.

Root Cause

The root cause is the absence of an allow list restricting which wkhtmltopdf options untrusted documents may set. The parser trusts every pdf-webkit-* meta tag in the source HTML and grants it precedence over caller-supplied configuration. URL sources are not scanned, and the scan is also skipped when the recommended dependency XML::LibXML is not installed, producing inconsistent security posture across deployments.

Attack Vector

An attacker submits HTML that contains one or more crafted meta tags. For example, a <meta name="pdf-webkit-enable-local-file-access" content="yes"> tag enables reading of files on the server hosting the renderer. Combined with an <img src="file:///etc/passwd"> reference, the contents of local files can be embedded into the resulting PDF and returned to the attacker. Other reachable switches such as --cookie-jar allow writing to attacker-selected filesystem paths. See the upstream issue discussion for technical detail.

Detection Methods for CVE-2026-16770

Indicators of Compromise

Presence of <meta name="pdf-webkit-*"> tags in HTML submitted by users or external systems
wkhtmltopdf process invocations that include --enable-local-file-access, --cookie-jar, or other file-affecting switches not set by the application
Generated PDFs that contain contents of local files such as /etc/passwd or application configuration

Detection Strategies

Inspect process command lines for wkhtmltopdf executions and compare arguments against the application's expected option set
Log and review any HTML input containing meta elements with name attributes matching the pdf-webkit- prefix
Audit application source for calls to PDF::WebKit->new that accept HTML from untrusted sources

Monitoring Recommendations

Alert on wkhtmltopdf command invocations that reference file:// URIs or local absolute paths in arguments
Monitor filesystem writes by the renderer process to paths outside its expected working directory
Track outbound content of generated PDFs for signatures of internal file contents leaving the environment

How to Mitigate CVE-2026-16770

Immediate Actions Required

Upgrade PDF::WebKit to a version that includes the fix from the MetaCPAN patch
Treat all HTML input to PDF::WebKit as untrusted and sanitize <meta> elements prior to rendering
Ensure XML::LibXML is installed so that the meta-tag scanning path executes as intended

Patch Information

A patch is available on MetaCPAN referenced as CVE-2026-16770-r1.patch. Review the GitHub issue discussion and the wkhtmltopdf status page for context, noting that wkhtmltopdf itself is no longer actively maintained. Migration to a supported renderer should be evaluated as a longer-term remediation.

Workarounds

Strip <meta name="pdf-webkit-*"> tags from input HTML before passing the document to the constructor
Restrict the calling process with filesystem sandboxing so options such as --enable-local-file-access cannot reach sensitive paths
Render only HTML that originates from trusted sources, avoiding user-submitted or third-party document content
Run wkhtmltopdf under a dedicated low-privilege account with no read access to application secrets or user data

bash

# Configuration example: strip attacker-controlled meta tags before rendering
perl -i -pe 's|<meta\s+name="pdf-webkit-[^"]*"[^>]*>||gi' input.html