EUVD-2026-48767Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (CPANSec) · only source for this CVE.
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.
Options are passed directly to the wkhtmltopdf command without sanitization.
Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection.
Version 0.6.0 was released with an incomplete fix for this issue.
Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.
AnalysisAI
Remote code execution in Catalyst::View::Wkhtmltopdf before 0.6.1 allows unauthenticated attackers to inject arbitrary shell commands via unsanitized PDF render options such as page_size, orientation, or margins. The incomplete fix in 0.6.0 still permits injection. CVSS 9.8, EPSS 0.67% (moderate probability), CISA SSVC indicates automatable and total impact, but no active exploitation reported.
Session ID disclosure in Catalyst::Plugin::Statsd for Perl (versions ≤0.10.0) occurs when the StatsD communication chann
Timing attack exposure in Catalyst::Plugin::Authentication (all versions through 0.10024) allows side-channel inference
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today