PDF::WebKit versions up to 1.2 for Perl use a two-argument open when reading the output path in to_pdf and stylesheet paths in _style_tag_for. The Perl diamond operator opens each supplied path with a 2‑arg open, which interprets strings beginning with a pipe or redirect as commands or file redirects. If untrusted data is supplied as the output filename or as a stylesheet entry, an attacker can execute arbitrary shell commands under the process UID, capture command output into the PDF, or truncate files with redirection. The flaw therefore gives attackers denial‑of‑service, data modification, and full code execution privileges on the server.

The vulnerability exists in the Perl module PDF::WebKit from the MITHALDU vendor, affecting all releases up to version 1.2. No newer fixed release is available, but a patch is published that changes the open call to a 3‑argument form, preventing interpretation of the arguments as shell commands.

The exploit requires the attacker to supply an untrusted path or stylesheet entry; no user interaction beyond that is needed. While an EPSS score or CVSS score is not provided, the potential for full command execution in a web context makes the risk significant. The vulnerability is not listed in the CISA KEV catalog, but the lack of a formal patch releases raises the likelihood of unnoticed exploitation.