Vulnerability record · CVE-2026-22781 · published 12 January 2026

CVE-2026-22781: Ritlabs tinyweb os command injection vulnerability

Ritlabs · Tinyweb

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

10.0 CVSS 4.0 Critical EPSS 2.5% · top 16.1% CWE-78 · OS command injection

10.0CVSS 4.0 base score

2.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Tinyweb Ritlabs

References

Link	Tags
https://github.com/maximmasiutin/TinyWeb/commit/876b7e2887f4ea5be3e18bb2af7313f23a283c96	Patch
https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-m779-84h5-72q2	Third Party Advisory
https://www.masiutin.net/tinyweb-cve-2025-cgi-command-injection.html	Third Party Advisory

Track CVE-2026-22781 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-27613Ritlabs tinyweb os command injection vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers …EPSS 1.4%25 Feb 2026 9.3CVE-2026-28497Ritlabs tinyweb integer overflow vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer …EPSS 0.67%6 Mar 2026 9.2CVE-2026-29046Ritlabs tinyweb improper input validation vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them i…EPSS 0.56%6 Mar 2026 8.7CVE-2026-27633Ritlabs tinyweb uncontrolled resource consumption vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denial of Service (DoS) vulnerability via me…EPSS 0.82%26 Feb 2026 8.7CVE-2026-27630Ritlabs tinyweb uncontrolled resource consumption vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack …EPSS 0.82%26 Feb 2026 8.6CVE-2024-34199Ritlabs tinyweb out-of-bounds write vulnerabilityTinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively large elements…EPSS 1.2%14 May 2024 5.5CVE-2024-5193Ritlabs tinyweb injection vulnerabilityA security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. …EPSS 0.66%22 May 2024 8.8CVE-2026-53266Linux kernel ebtables SNAT out-of-bounds write in ARP rewriteThe ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA byt…KEVEPSS 0.65%analysed25 Jun 2026

Source: NIST National Vulnerability Database (record CVE-2026-22781), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.