PT-2026-2293 · Tinyweb · Tinyweb

Maxim Masutin · Publicado 2026-01-12 · Atualizado 2026-01-12 · CVE-2026-22781

Positive Technologies (AI Summary)

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 1.98

Description TinyWeb is a web server for Win32. Versions of TinyWeb HTTP Server before 1.98 contain a flaw that allows for operating system command injection. This occurs through CGI ISINDEX-style query parameters, which are passed as command-line arguments to a CGI executable using the Windows CreateProcess() function. A remote attacker who does not need to be authenticated can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. The vulnerable parameters are passed to the CreateProcess() function.

Recommendations Update to TinyWeb version 1.98 or later.

Exploit

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-22781

GHSA-M779-84H5-72Q2

Produtos afetados

Tinyweb

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22781.json · Exploit
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-m779-84h5-72q2 · Nota
• https://github.com/maximmasiutin/TinyWeb/commit/876b7e2887f4ea5be3e18bb2af7313f23a283c96 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-22781 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-22781 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2010788147488317528 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2010784093437374913 · Publicação no Twitter
• https://masiutin.net/tinyweb-cve-2025-cgi-command-injection.html · Nota
• https://twitter.com/vuldb/status/2010806795363905722 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2010824736800981085 · Publicação no Twitter