CVE-2026-22781

Critical

Published: 12/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

Risk Assessment

An unauthenticated attacker can take over the server by executing arbitrary commands, potentially leading to full system and data compromise.

Recommendation

Immediately upgrade TinyWeb to version 1.98 or later, which contains the fix.

Original NVD description (English source)

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.