CVE-2026-22781
Critical
Description
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
SeverityCritical
CVSS9.8
Exploit probability—
ProductRitlabs Tinyweb
PublishedJan 12, 2026
First seenJan 12, 2026
Weakness typeCWE-78OS command injection
How to fix
Update
- ritlabs tinyweb1.98 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ritlabs tinyweb | v < 1.98 | 1.98 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.