CVE-2026-22781 TinyWeb CGI Command Injection

What is CVE-2026-22781?

CVE-2026-22781 is a critical command injection vulnerability in maximmasiutin TinyWeb, published on 12 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

Weakness: CWE-78

Which versions are affected by CVE-2026-22781?

It affects 1 product.

Products include Ritlabs Tinyweb.

How do I fix CVE-2026-22781?

No fix has been published for CVE-2026-22781 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-22781 being exploited?

There is no known exploitation of CVE-2026-22781 in the wild and no public exploit code.

Other vulnerabilities in maximmasiutin TinyWeb

• CVE-2026-27613 CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam) Critical 10.0
• CVE-2026-28497 TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling) Critical 9.3
• CVE-2026-29046 TinyWeb: HTTP Header Control Character Injection into CGI Environment Critical 9.2
• CVE-2026-27630 TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris) High 8.7
• CVE-2026-27633 TinyWeb has Unbounded Content-Length Memory Exhaustion (DoS) High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m779-84h5-72q2.