PT-2026-2293 · Tinyweb · Tinyweb

Maxim Masutin · Published 2026-01-12 · Updated 2026-01-12 · CVE-2026-22781

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 1.98

Description TinyWeb is a web server for Win32. Versions of TinyWeb HTTP Server before 1.98 contain a flaw that allows for operating system command injection. This occurs through CGI ISINDEX-style query parameters, which are passed as command-line arguments to a CGI executable using the Windows CreateProcess() function. A remote attacker who does not need to be authenticated can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. The vulnerable parameters are passed to the CreateProcess() function.

Recommendations Update to TinyWeb version 1.98 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-22781

GHSA-M779-84H5-72Q2

Affected Products

Tinyweb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22781.json · Exploit
• https://github.com/maximmasiutin/TinyWeb/commit/876b7e2887f4ea5be3e18bb2af7313f23a283c96 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22781 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22781 · Vendor Advisory
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-m779-84h5-72q2 · Note
• https://twitter.com/CVEnew/status/2010788147488317528 · Twitter Post
• https://twitter.com/0dayPublishing/status/2010784093437374913 · Twitter Post
• https://masiutin.net/tinyweb-cve-2025-cgi-command-injection.html · Note
• https://twitter.com/vuldb/status/2010806795363905722 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2010824736800981085 · Twitter Post