PT-2026-22037 · Php+1 · Php+1

Maximmasiutin · Published 2026-02-25 · Updated 2026-03-04 · CVE-2026-27613

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 2.01

Description TinyWeb, a web server for Win32, contains a flaw where unauthenticated remote attackers can circumvent the CGI parameter security controls. This can lead to source code disclosure or remote code execution (RCE), depending on the server’s configuration and the CGI executable being used. Systems hosting CGI scripts, such as PHP, are potentially affected. The issue is addressed in version 2.01.

Recommendations Update to version 2.01. If an immediate upgrade is not possible, ensure STRICT CGI PARAMS is enabled. If hosting PHP, consider placing the server behind a Web Application Firewall (WAF) that blocks URL query string parameters beginning with a hyphen (-) or containing encoded double quotes (%22).

Exploit

Fix

RCE

Argument Injection

OS Command Injection

Weakness Enumeration

CWE-88

CWE-78

Related Identifiers

CVE-2026-27613

GHSA-RFX5-FH9M-9JJ9

Affected Products

Php

Tinyweb

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27613.json · Exploit
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-rfx5-fh9m-9jj9 · Vendor Advisory
• https://github.com/maximmasiutin/TinyWeb/commit/d9dbda8db49da69d2160e1c527e782b73b5ffb6b · Patch
• https://osv.dev/vulnerability/CVE-2026-27613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27613 · Security Note
• https://github.com/maximmasiutin/TinyWeb/releases/tag/v2.01 · Note
• https://twitter.com/infoflowcloud/status/2027006209157423149 · Twitter Post
• https://twitter.com/CVEnew/status/2027004269296071011 · Twitter Post
• https://twitter.com/offseq/status/2026809481716244875 · Twitter Post
• https://t.me/CVEtracker/45783 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026809163980886517 · Twitter Post
• https://t.me/cveNotify/154063 · Telegram Post
• https://masiutin.net/tinyweb-cve-2026-27613.html · Note