CVE-2026-22781

critical · 10

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

CVSS

2.5%

EPSS (exploit prob.)

84th

EPSS percentile

2026-01-12

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
ritlabs	tinyweb	< 1.98

Check a specific version with /api/v1/cve/match.

References

https://github.com/maximmasiutin/TinyWeb/commit/876b7e2887f4ea5be3e18bb2af7313f23a283c96
https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-m779-84h5-72q2
https://www.masiutin.net/tinyweb-cve-2025-cgi-command-injection.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-22781