CVE-2026-22781
CriticalSummary
TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
Risk Assessment
An unauthenticated attacker can take over the server by executing arbitrary commands, potentially leading to full system and data compromise.
Recommendation
Immediately upgrade TinyWeb to version 1.98 or later, which contains the fix.
Other vulnerabilities in TinyWeb
See all- CVE-2026-67185High
TinyWeb through version 0.0.8 has a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path. The path is concatenated without normalization, dot-segment removal, or boundary checks. Attackers can expose sensitive files like credential stores and private keys when the server runs as root.
- CVE-2026-67184High
TinyWeb through version 0.0.8 has a null pointer dereference vulnerability allowing unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. HttpParser::execute() fails to allocate the Url object, and buildResponse() dereferences the NULL pointer without checking the valid_requ flag, causing SIGSEGV and permanent server shutdown after repeating on all workers.
- CVE-2026-67183High
TinyWeb through version 0.0.8 has a memory leak vulnerability allowing unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request allocates Url, HttpHeaders, and HttpHeader objects via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker memory to grow by ~20-28 kB per request until the process is killed.
Original NVD description (English source)
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.