CVE-2026-22781CRITICAL 9.8EPSS p80.0%

CVE-2026-22781CVE-2026-22781

Description

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS2.17% probability of exploitation · percentile 80.0% · 2026-06-18T12:00:27Z
Published2026-01-12
Last modified2026-01-16

Underlying weaknesses· 1

CWE-78

References

  1. https://github.com/maximmasiutin/TinyWeb/commit/876b7e2887f4ea5be3e18bb2af7313f23a283c96
  2. https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-m779-84h5-72q2
  3. https://www.masiutin.net/tinyweb-cve-2025-cgi-command-injection.html

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')cwe-780%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-27613
CVE
CVE-2026-29046
CVE
CVE-2026-28497
CVE
CVE-2025-3267
CVE
CVE-2025-3266
CVE
CVE-2026-25111
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.