VulnerabilityAnalyzed

CVE-2026-22781

TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters.

CRITICAL 10.0EPSS 2.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

CVSS 4.0: 10.0 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 2.47% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: ritlabs/tinyweb
Source: security-advisories@github.com

References

https://github.com/maximmasiutin/TinyWeb/commit/876b7e2887f4ea5be3e18bb2af7313f23a283c96Patch
https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-m779-84h5-72q2Third Party Advisory
https://www.masiutin.net/tinyweb-cve-2025-cgi-command-injection.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.