CVE Intelligence
Analysis AI-assisted

CVE-2026-22781: TinyWeb HTTP Server CGI OS Command Injection

CVE-2026-22781 is an OS command injection flaw in the TinyWeb HTTP Server for Win32, where CGI query parameters are passed as command-line arguments to a CGI executable. The record states that versions before 1.98 are affected and that the issue is fixed in 1.98. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

TinyWeb is a web server for Win32 written in Delphi. According to the record, TinyWeb HTTP Server versions before 1.98 pass CGI ISINDEX-style query parameters to a CGI executable as command-line arguments through CreateProcess(), which can lead to OS command injection. The weakness is classified as CWE-78 and the fix is listed for 1.98.

Impact

  • According to the record, an unauthenticated remote attacker may be able to run arbitrary commands on the affected server.
  • The NVD base score is 9.8 (critical). The SSVC technical impact is listed as total.
  • Because command execution would run with the privileges of the web server process, confidentiality, integrity and availability could all be affected (inference).

Affected products and versions

  • Maximmasiutin TinyWeb: versions before 1.98 are listed as affected.
  • Ritlabs Tinyweb: versions before 1.98 are listed as affected.
  • Fixed version named in the record: 1.98.
  • Whether other forks, builds or deployments are affected is unknown from the sources consulted.

Exploitation status

The record marks this CVE as not listed in the CISA KEV catalog. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The record reports an EPSS probability of 0.02438 and an SSVC exploitation value of none.

Remediation and mitigation

  • Upgrade TinyWeb to 1.98, the version named in the advisory and patch, or to a build that includes the fix.
  • Review the patch commit and the GitHub advisory GHSA-m779-84h5-72q2 to confirm the affected code path.
  • If an upgrade cannot be applied immediately, reduce exposure by limiting access to the web server, disabling unneeded CGI executables and running the server with least privilege (inference).
  • Verify that no unexpected CGI handlers remain in production.

Detection guidance

  • Review web server logs for requests to CGI endpoints that contain unusual shell-related characters or abnormally long query strings.
  • Monitor for unexpected child processes started by the TinyWeb server process, especially command interpreters.
  • Compare CGI executables and server binaries against known-good copies after any suspicious activity.

Limitations of the available information

  • The sources do not provide a complete list of affected builds beyond the endpoints given in the record.
  • The sources do not describe the exact set of characters or request structures that were tested.
  • Whether vendor or distribution builds other than those named have been patched is unknown.
  • No confirmed exploitation in the wild is documented in the sources consulted.

Frequently asked questions

Is this TinyWeb vulnerability fixed?

According to the record, the issue is fixed in 1.98, and the listed patch is a commit in the TinyWeb repository. Systems running versions before 1.98 should be reviewed and upgraded.

Is this CVE being actively exploited?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted. Defenders should still prioritize patching because the reported base score is critical.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.