CVE-2026-22781 | THREATINT

Description

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

PUBLISHED Reserved 2026-01-09 | Published 2026-01-12 | Updated 2026-01-12 | Assigner GitHub_M

CRITICAL: 10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

< 1.98

affected

References

github.com/...inyWeb/security/advisories/GHSA-m779-84h5-72q2

github.com/...ommit/876b7e2887f4ea5be3e18bb2af7313f23a283c96

www.masiutin.net/tinyweb-cve-2025-cgi-command-injection.html

cve.org (CVE-2026-22781)

nvd.nist.gov (CVE-2026-22781)

Download JSON