CVE-2026-17431: PDF::WebKit for Perl RCE Vulnerability

CVE-2026-17431 Overview

CVE-2026-17431 is an operating system (OS) command injection vulnerability affecting PDF::WebKit versions through 1.2 for Perl. The flaw stems from unsafe use of Perl's 2-argument open() in the to_pdf and _style_tag_for routines. Attackers can supply a path that begins or ends with a pipe character to execute arbitrary commands under the process UID. Paths beginning with > or >> can also truncate or append to arbitrary files on disk. The issue is tracked under CWE-73: External Control of File Name or Path.

Critical Impact
Any caller that forwards untrusted input as the output path or as a stylesheets entry can execute arbitrary commands under the Perl process UID or truncate arbitrary files.

Affected Products

PDF::WebKit for Perl, all versions through 1.2
Perl applications invoking PDF::WebKit::to_pdf with attacker-influenced output paths
Perl applications invoking PDF::WebKit::to_file or passing untrusted values into the stylesheets list

Discovery Timeline

2026-08-13 - CVE CVE-2026-17431 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-17431

Vulnerability Analysis

The root defect is Perl's legacy 2-argument open(), which interprets special characters in the filename argument as I/O directives. PDF::WebKit's to_pdf reads the generated PDF back from the path supplied by the caller. _style_tag_for reads each entry of the stylesheets list by assigning the path to a local @ARGV and iterating with the diamond operator <>, which internally uses 2-arg open() on each element.

A value formatted as "| cmd" or "cmd |" is executed as a shell command instead of being opened as a file. A value beginning with "> path" or ">> path" opens the target for write or append, truncating existing content. to_file forwards its path argument to to_pdf, exposing the same read path.

With the "cmd |" form, the command's standard output replaces the PDF content returned to the caller, giving the attacker a channel for exfiltrating results. Stylesheets can only be attached to an HTML source, so URL or file source callers expose only the output path vector.

Root Cause

The library relies on Perl's 2-argument open() and the diamond operator <> without sanitizing or forcing 3-argument form. This design pattern conflates filenames with I/O mode specifiers, permitting metacharacter-driven command execution.

Attack Vector

An attacker who can influence the output path passed to to_pdf or to_file, or any entry in the stylesheets array of an HTML-sourced instance, supplies a value containing a leading or trailing pipe or a redirection prefix. See the MetaCPAN patch for CVE-2026-17431 and the upstream issue discussion for the corrected code paths.

// Example exploitation is described in prose only; no verified public PoC code is available.
// Illustrative concept: a caller passing an attacker-controlled string such as
// "id |" as the output path causes the diamond read to execute `id` and return
// its output in place of the generated PDF.

Detection Methods for CVE-2026-17431

Indicators of Compromise

Unexpected child processes spawned by Perl workers running PDF::WebKit, particularly short-lived shells or reconnaissance binaries such as id, whoami, curl, or wget.
PDF outputs containing non-PDF content, such as command stdout, indicating a "cmd |" payload was processed.
Files unexpectedly truncated or created adjacent to PDF output directories, consistent with "> path" payloads.

Detection Strategies

Audit application logs for to_pdf, to_file, and stylesheets arguments containing |, >, or >> characters.
Enable process-execution telemetry on hosts running Perl PDF workers and alert on shell invocations parented by the Perl interpreter.
Correlate HTTP request parameters that flow into PDF generation with subsequent process launches on the backend host.

Monitoring Recommendations

Ship endpoint process, file, and network telemetry to a centralized data lake for retrospective hunting of PDF::WebKit abuse patterns.
Alert on write or truncate operations to files outside the designated PDF output directory by the Perl service account.
Track outbound network connections initiated by Perl worker processes to catch data exfiltration via injected commands.

How to Mitigate CVE-2026-17431

Immediate Actions Required

Upgrade PDF::WebKit beyond version 1.2 once a fixed release is published on CPAN, or apply the vendor patch directly.
Audit all application code paths that pass user-influenced values to to_pdf, to_file, or the stylesheets option and reject inputs containing |, >, or >>.
Run Perl PDF generation workers under a dedicated low-privilege UID with restricted filesystem access.

Patch Information

A patch is available via MetaCPAN at CVE-2026-17431-r1.patch. See also the OpenWall oss-security advisory and the upstream GitHub issue for maintainer discussion. Note that PDF::WebKit depends on wkhtmltopdf, which is no longer maintained; operators should evaluate migration to an actively supported PDF rendering library.

Workarounds

Wrap all output paths and stylesheet entries with strict allowlist validation, permitting only known-safe directories and filename patterns before invoking the library.
Monkey-patch or fork PDF::WebKit to replace 2-argument open() and diamond-operator reads with explicit 3-argument open(my $fh, '<', $path) calls.
Constrain the Perl worker with mandatory access controls such as AppArmor or SELinux to block execve of shells and writes outside the PDF output directory.

bash

# Configuration example: restrict the service account and validate input paths
# 1) Run the Perl PDF worker under an isolated UID
useradd --system --shell /usr/sbin/nologin pdfworker
chown -R pdfworker:pdfworker /var/lib/pdf-output
chmod 700 /var/lib/pdf-output

# 2) Reject dangerous metacharacters at the application boundary (Perl snippet)
# die "invalid path" if $path =~ /^[|>]|\|\s*$/;

# 3) Deny shell execution from the worker via AppArmor (excerpt)
# deny /bin/sh mrix,
# deny /usr/bin/bash mrix,