External risk intelligence

Catalyst::View::Wkhtmltopdf Perl Module Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16766

This is a Perl module used within Catalyst web applications to generate PDFs. Web applications that utilize this component to provide document generation features to end users are commonly deployed as internet-facing services or APIs, creating a reachable attack surface.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Catalyst::View::Wkhtmltopdf for Perl, which could allow attackers to execute arbitrary commands on affected systems. The issue arises from how user-supplied options are handled when generating PDF documents, potentially enabling unauthorized command execution if these options are not properly validated. Given that the underlying wkhtmltopdf project is no longer actively developed, migrating to alternative solutions is recommended.

Remote code execution through PDF options.
Confirms need for internal review and potential migration.
Assess exposure and plan for alternative solutions.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by sending specially crafted options to a web application that uses Catalyst::View::Wkhtmltopdf to generate PDFs. Because the application does not properly sanitize these options before passing them to the underlying `wkhtmltopdf` command, an attacker can inject malicious shell commands, potentially leading to remote code execution on the server.

Unauthenticated access to a vulnerable web application.
Providing unsanitized PDF render options.
Remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

When user-controlled options for PDF rendering, such as page size or margins, are passed without proper validation to Catalyst::View::Wkhtmltopdf, an attacker could inject and execute arbitrary shell commands on the server. This could affect web applications that use this module to generate PDFs from user-supplied data, potentially leading to a compromise of the application's environment.

Server-side commands could be executed.
User-controlled options are passed to wkhtmltopdf.
Sensitive system information or functionality may be exposed.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability likely affects application owners and platform teams responsible for web applications that generate PDFs using Catalyst::View::Wkhtmltopdf. The first step is to inventory where this module is deployed, assess its exposure, identify the accountable owner, and then plan remediation, considering that the wkhtmltopdf project is no longer maintained.

Application owners should prioritize this.
Verify reachability and business criticality.
Plan migration to alternative solutions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Catalyst::View::Wkhtmltopdf?

This is a Perl module designed for the Catalyst web framework. It serves as a bridge, allowing developers to generate PDF documents by invoking the wkhtmltopdf tool. It is typically used in web applications that offer features like report generation, invoice printing, or document downloads, processing data into a format that can be easily shared or saved.

How does CVE-2026-16766 work?

The vulnerability involves a class of weakness known as Improper Neutralization of Special Elements used in an OS Command, or CWE-78. In this specific CVE, the module fails to sanitize inputs before passing them to the system shell. If an application takes user-provided data—such as page size, margins, or orientation settings—and feeds them directly into the underlying command, an attacker can append malicious instructions that the server will execute.

What triggers this command injection?

An attacker triggers this by providing specially crafted, malicious input to a parameter that the application subsequently uses to configure the PDF rendering process. The bug is only triggered when these specific rendering options are exposed to and controlled by a user. If an application strictly uses hard-coded, static configurations that cannot be altered by end users, it does not provide the necessary pathway for this specific injection attack.

Who is at risk from this vulnerability?

According to Halo Surface Signal, applications using this component to provide document generation are frequently internet-facing. This creates a reachable attack surface, meaning anyone with network access to the web application could potentially trigger the bug. If your service allows users to interact with PDF generation features, you should consider the application highly accessible to outside actors.

How should I respond to CVE-2026-16766?

Begin by identifying all web applications in your environment that utilize this specific Perl module. Once located, evaluate these systems to determine if user-controlled input affects the PDF rendering options. Because the underlying wkhtmltopdf tool is no longer maintained, applying software updates may be an incomplete solution. The most effective long-term response is to plan a migration to a modern, actively supported alternative for document generation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.