GHSA-rfx5-fh9m-9jj9: CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)

Q: Which deployments are most exposed to this issue?

Deployments running TinyWeb versions earlier than 2.01 that host CGI scripts are affected. Risk is especially high where CGI uses interpreted-language executables, such as php-cgi.exe, because the outcome can be remote code execution depending on the CGI executable and server configuration.

Q: Does exploitation require authentication or user interaction?

No. The vulnerability can be exploited by an unauthenticated remote attacker, with no user interaction required.

Q: What should teams do if they cannot upgrade immediately?

Ensure STRICT_CGI_PARAMS is enabled; it is defined by default in define.inc. Avoid CGI executables that accept dangerous command-line flags, such as php-cgi.exe; for PHP deployments, use a WAF rule that blocks query-string parameters beginning with a hyphen or containing encoded double quotes (%22).

Q: How can an administrator determine whether mitigation is needed?

Check whether the server runs a TinyWeb version earlier than 2.01 and hosts CGI scripts. Also verify whether STRICT_CGI_PARAMS is enabled and whether CGI executables such as php-cgi.exe are in use.

Published Feb 25, 2026

Updated

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the specific CGI executable in use, the impact is either source code disclosure or remote code execution (RCE). Anyone hosting CGI scripts (particularly interpreted languages like PHP) using vulnerable versions of TinyWeb is impacted. The problem has been patched in version 2.01. If upgrading is not immediately possible, ensure STRICTCGIPARAMS is enabled (it is defined by default in define.inc) and/or do not use CGI executables that natively accept dangerous command-line flags (such as php-cgi.exe). If hosting PHP, consider placing the server behind a Web Application Firewall (WAF) that explicitly blocks URL query string parameters that begin with a hyphen (-) or contain encoded double quotes (%22).

Affected Software

1 affected component

TinyWeb TinyWeb<2.01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TinyWeb to a version that resolves this vulnerability.
Fixed in 2.01
Configuration
Ensure STRICT_CGI_PARAMS is enabled; it is defined by default in define.inc.
TinyWeb STRICT_CGI_PARAMS = enabled
Compensating control
For PHP hosting, place the server behind a Web Application Firewall (WAF) that blocks URL query-string parameters beginning with '-' or containing encoded double quotes (%22).
Compensating control
Do not use CGI executables that natively accept dangerous command-line flags, such as php-cgi.exe.

Event History

Feb 25, 2026

CVE Published

via OSV·10:58 PM

Data Sourced

via OSV·10:58 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Deployments running TinyWeb versions earlier than 2.01 that host CGI scripts are affected. Risk is especially high where CGI uses interpreted-language executables, such as php-cgi.exe, because the outcome can be remote code execution depending on the CGI executable and server configuration.

Does exploitation require authentication or user interaction?

No. The vulnerability can be exploited by an unauthenticated remote attacker, with no user interaction required.

What should teams do if they cannot upgrade immediately?

Ensure STRICT_CGI_PARAMS is enabled; it is defined by default in define.inc. Avoid CGI executables that accept dangerous command-line flags, such as php-cgi.exe; for PHP deployments, use a WAF rule that blocks query-string parameters beginning with a hyphen or containing encoded double quotes (%22).

How can an administrator determine whether mitigation is needed?

Check whether the server runs a TinyWeb version earlier than 2.01 and hosts CGI scripts. Also verify whether STRICT_CGI_PARAMS is enabled and whether CGI executables such as php-cgi.exe are in use.

GHSA-rfx5-fh9m-9jj9: CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

Does exploitation require authentication or user interaction?

What should teams do if they cannot upgrade immediately?

How can an administrator determine whether mitigation is needed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

Does exploitation require authentication or user interaction?

What should teams do if they cannot upgrade immediately?

How can an administrator determine whether mitigation is needed?