CPANSA-PDF-WebKit-2026-17431: PDF-WebKit vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-08-13T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-08-13T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 6.1 | Severity | Medium |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for.
to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read.
Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.
Vulnerabilities
CVE-2026-17431
Vulnerability DescriptionPDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for.
to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read.
Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.
| Weakness | CWE-73 : External Control of File Name or Path |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| PDF-WebKit greater than 0 |
|
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-PDF-WebKit-2026-17431 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-pdf-webkit-2026-17431.json - https://github.com/kingpong/perl-PDF-WebKit/issues/8 external
https://github.com/kingpong/perl-PDF-WebKit/issues/8 - https://security.metacpan.org/patches/P/PDF-WebKit/1.2/CVE-2026-17431-r1.patch external
https://security.metacpan.org/patches/P/PDF-WebKit/1.2/CVE-2026-17431-r1.patch - https://wkhtmltopdf.org/status.html external
https://wkhtmltopdf.org/status.html - http://www.openwall.com/lists/oss-security/2026/08/13/3 external
http://www.openwall.com/lists/oss-security/2026/08/13/3 - CVE-2026-17431 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-17431
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Thu Aug 13 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/