CVE-2026-22781: TinyWeb CGI Command Injection
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22781?
CVE-2026-22781 is considered a high severity vulnerability due to the potential for remote code execution via command injection.
How do I fix CVE-2026-22781?
To fix CVE-2026-22781, upgrade TinyWeb HTTP Server to version 1.98 or later.
What types of systems are affected by CVE-2026-22781?
CVE-2026-22781 affects any system running TinyWeb HTTP Server versions prior to 1.98.
What is the nature of vulnerability in CVE-2026-22781?
CVE-2026-22781 is a command injection vulnerability that allows attackers to execute arbitrary OS commands through CGI ISINDEX-style query parameters.
Can CVE-2026-22781 lead to a data breach?
Yes, if exploited, CVE-2026-22781 can lead to unauthorized access, data breaches, or complete system compromise.