CVE Intelligence
Analysis AI-assisted

CVE-2026-27613: TinyWeb CGI Parameter Injection via STRICT_CGI_PARAMS Bypass

CVE-2026-27613 is a CGI parameter injection flaw in TinyWeb versions before 2.01 that lets unauthenticated remote attackers bypass the server's CGI parameter protections. Depending on configuration and the CGI executable in use, the result can be source code disclosure or remote code execution. The record states the issue is fixed in 2.01, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

TinyWeb is a web server for HTTP and HTTPS written in Delphi for Win32. According to the CVE record, CVE-2026-27613 allows unauthenticated remote attackers to bypass the server's CGI parameter protections, which the record ties to STRICT_CGI_PARAMS and EscapeShellParam. The weakness is classified as OS command injection (CWE-78).

Impact

  • Depending on server configuration and the CGI executable in use, the impact is either source code disclosure or remote code execution.
  • Sites hosting CGI scripts, especially interpreted languages such as PHP, are described as affected when running vulnerable versions.
  • The NVD CVSS base score is 9.8 (critical). GitHub assigns a score of 10 under the newer CVSS scheme.

Affected products and versions

  • Maximmasiutin TinyWeb: versions before 2.01.
  • Ritlabs Tinyweb: versions before 2.01.
  • The record states the problem is patched in 2.01.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The record's SSVC data marks exploitation as none and automatable as yes. The EPSS probability is 0.01534 with a percentile of 0.74638.

Remediation and mitigation

  • Upgrade to the fixed version 2.01 as soon as possible.
  • If an immediate upgrade is not possible, verify that STRICT_CGI_PARAMS is enabled. The record says it is defined by default in define.inc.
  • Avoid CGI executables that natively accept dangerous command-line flags, such as php-cgi.exe.
  • For PHP hosting, consider a Web Application Firewall that blocks query string parameters beginning with a hyphen or containing encoded double quotes.

Detection guidance

  • Review web server logs for CGI requests with unusual query string parameters, such as values starting with a hyphen or containing encoded quote characters.
  • Monitor for unexpected child processes started by the web server process and for responses that unexpectedly expose script source.
  • Inventory TinyWeb instances and their versions, including legacy or embedded deployments.

Limitations of the available information

  • The record does not provide detection signatures or indicators of compromise.
  • The record does not describe in detail how the bypass works beyond the title and description, so the exact conditions for each outcome are unknown.
  • The impact depends on the CGI executable and configuration, which are not specified for a given deployment.

Frequently asked questions

Which TinyWeb versions are affected by CVE-2026-27613?

The record lists Maximmasiutin TinyWeb and Ritlabs Tinyweb versions before 2.01 as affected. The problem is stated to be patched in 2.01.

Is this CVE known to be exploited in the wild?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The record's SSVC data marks exploitation as none.

What can be done if upgrading is not immediately possible?

The record suggests verifying that STRICT_CGI_PARAMS is enabled, avoiding CGI executables that accept dangerous command-line flags natively, and considering a Web Application Firewall for PHP hosting.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.