Security readout for executives and security teams
Plain-English summary
A flaw in Catalyst::View::Wkhtmltopdf before 0.6.1 can let an unauthenticated attacker run operating-system commands when an application forwards user-controlled PDF options. Successful exploitation could compromise data, alter systems, or disrupt service. Risk depends on whether users can influence options such as page size, orientation, or margins.
Executive priority
Treat as an urgent remediation for internet-facing PDF-generation services. Prioritize within the emergency patch cycle where user input reaches renderer options. Require owners to prove version and data-flow status, while beginning replacement planning because wkhtmltopdf is discontinued. Systems without this package or without user-controlled options can be deprioritized after documented validation.
Technical view
The Perl package passes PDF rendering options directly into the wkhtmltopdf shell command without adequate sanitization, creating CWE-78 command injection. The issue is remotely exploitable with low complexity and no required privileges or user interaction when vulnerable applications expose controllable render options. Version 0.6.0 contains an incomplete fix; 0.6.1 addresses the issue.
Likely exposure
Highest exposure exists in internet-facing Catalyst applications using Catalyst::View::Wkhtmltopdf earlier than 0.6.1 and mapping request data into PDF options. Installations not accepting user-controlled render options have lower immediate exploitability, but remain vulnerable components requiring review. The source bundle does not identify specific deployed applications or organizations.
Exploitation context
The CVSS 3.1 score is 9.8, reflecting potential remote, unauthenticated code execution with high confidentiality, integrity, and availability impact. The supplied record is not in KEV, and the cited sources do not establish active exploitation. Public issue tracking exists, so defenders should not treat absence of confirmed exploitation as absence of risk.
Researcher notes
The decisive exposure condition is data flow from untrusted input into command-line render options. Review wrappers and application defaults, not only obvious form fields. Version 0.6.0 must remain classified as vulnerable because its fix was incomplete. The supplied evidence supports the vulnerability and 0.6.1 remediation, but provides no confirmed exploitation telemetry or affected deployment counts.
Mitigation direction
- Upgrade Catalyst::View::Wkhtmltopdf to version 0.6.1 or later; do not rely on version 0.6.0.
- Stop forwarding user-controlled values into PDF render options until remediation is verified.
- Restrict accepted PDF options to explicitly validated values as defense in depth.
- Plan migration from wkhtmltopdf because the underlying project is no longer maintained.
- Check the vendor advisory and release notes for any updated remediation guidance.
Validation and detection
- Inventory Catalyst applications and identify every installed Catalyst::View::Wkhtmltopdf version.
- Trace whether request parameters can influence page size, orientation, margins, or other renderer options.
- Confirm production and build manifests resolve to version 0.6.1 or later.
- Review PDF-generation code for direct or indirect forwarding of untrusted option values.
- After upgrading, run existing PDF workflows and security regression tests in a safe environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-16766 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/robrwo/Catalyst-View-Wkhtmltopdf/security/advisories/GHSA-42w4-jj8w-6p98CVE reference, CPANSec · vendor-advisory
- https://metacpan.org/release/RRWO/Catalyst-View-Wkhtmltopdf-v0.6.1/changesCVE reference, CPANSec · release-notes
- https://github.com/mc7244/Catalyst-View-Wkhtmltopdf/issues/6CVE reference, CPANSec · issue-tracking
- https://wkhtmltopdf.org/status.htmlCVE reference, CPANSec
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.