CVE 설명

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

CVE 해결 방법

Upgrade to Catalyst::View::Wkhtmltopdf version 0.6.1 or later.

CVE 정보

관련 약점

CWE-ID	약점 이름	출처
CWE-78	Improper Neutralization of Special Elements used in an OS Command The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

참고 자료

https://github.com/robrwo/Catalyst-View-Wkhtmltopdf/security/advisories/GHSA-42w4-jj8w-6p98
Tags : vendor-advisory

https://metacpan.org/release/RRWO/Catalyst-View-Wkhtmltopdf-v0.6.1/changes
Tags : release-notes

https://github.com/mc7244/Catalyst-View-Wkhtmltopdf/issues/6
Tags : issue-tracking

https://wkhtmltopdf.org/status.html

CVE-2026-16766 : 상세 정보

CVE-2026-16766