Critical severity · published Jan 12, 2026
CVE-2026-22781
TinyWeb CGI Command Injection
9.8
CVSS
2.4%
EPSS
No
On KEV
Description
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
TinyWeb · maximmasiutin
< 1.98 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22781
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22781
Patch
https://github.com/maximmasiutin/TinyWeb/commit/876b7e2887f4ea5be3e18bb2af7313f23a283c96
Third Party Advisory
https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-m779-84h5-72q2
Third Party Advisory
https://www.masiutin.net/tinyweb-cve-2025-cgi-command-injection.html
More from TinyWeb
9.8
CVE-2026-27613
CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)
9.1
CVE-2026-28497
TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)
8.2
CVE-2026-29046
TinyWeb: HTTP Header Control Character Injection into CGI Environment
7.5
CVE-2026-27633
TinyWeb has Unbounded Content-Length Memory Exhaustion (DoS)
7.5
CVE-2026-27630
TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)