Critical severity9.8OSV Advisory· Published Jan 12, 2026· Updated Jun 17, 2026
CVE-2026-22781
CVE-2026-22781
Description
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: v1.95, v1.96, v1.97
Patches
Vulnerability mechanics
References
3- github.com/maximmasiutin/TinyWeb/commit/876b7e2887f4ea5be3e18bb2af7313f23a283c96nvdPatch
- github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-m779-84h5-72q2nvdThird Party Advisory
- www.masiutin.net/tinyweb-cve-2025-cgi-command-injection.htmlnvdThird Party Advisory
News mentions
0No linked articles in our index yet.