VulnSocial

CVE-2026-16766Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-25); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-25: 2Mentions · 2026-07-28: 1Patch / Workaround · 2026-07-28: 1Technical Details · 2026-07-25: 1Technical Details · 2026-07-28: 107-2507-28
Signal classification3 categories
Disclosure
133.3%
General
133.3%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-252
Disclosure1General1
2026-07-281
Patch1
Full discourse3 posts
  • SecAlerts@SecAlertsCo
    Patch

    🔧 CVE-2026-16766: Catalyst::View::Wkhtmltopdf for Perl (before 0.6.1) passes PDF render options directly to the wkhtmltopdf shell command unsanitized — full RCE. CVSS 9.8. Upgrade now. #cybersecurity #perl #vulnerabilities #ciso https://secalerts.co/vulnerability/CVE-2026-16766?utm_campaign=x https://t.co/D9evjBryyy

    Post summary

    The tweet discloses CVE-2026-16766, a full RCE in Catalyst::View::Wkhtmltopdf (before 0.6.1) with CVSS 9.8, and urges users to upgrade to remediate the flaw.

    0001096
    871 followersView on X
  • MalwareObserver@MalwareObserver
    Disclosure

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-16766](https://github.com/mc7244/Catalyst-View-Wkhtmltopdf/issues/6) Catalyst::View::Wk... https://github.com/mc7244/Catalyst-View-Wkhtmltopdf/issues/6 #PatchManagement #Vulnerability #CVE

    Post summary

    The post merely announces CVE-2026-16766 and points to a GitHub issue for further details, with no additional information on exploitation, patches, or technical specifics.

    0000025
    16 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-16766 Remote Code Execution via Shell Command Injection in Catalyst::View::Wkhtmltopdf Before 0.6.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-16766

    Post summary

    The post identifies a CVE with a technical description of a shell command injection RCE, but offers no PoC, exploitation details, patch information, or evidence of in‑the‑wild activity.

    00000113
    4.1K followersView on X

Explore more

Back to dashboard