CVE-2026-22781 is a critical OS command injection flaw (CVSS 9.8) in TinyWeb, the Delphi web server for Win32, before version 1.98. CGI query parameters become command line arguments, so an unauthenticated attacker can inject shell metacharacters. The fix is TinyWeb 1.98, or remove CGI scripts as a workaround.
What's affected
TinyWeb HTTP Server before 1.98. The fixed version is 1.98, dated 23 November 2025 in the advisory.
The flaw affects setups that use CGI through the cgi-bin directory. The advisory lists the possible impacts as code execution, information disclosure, denial of service and privilege escalation.
How to check if you're exposed
Find the executable and read its version, and check whether CGI is in use.
dir cgi-bin
Run that in the TinyWeb folder on the Windows host. If cgi-bin holds scripts or executables and the version is older than 1.98, you are exposed. If you run no CGI scripts, the vulnerable path described in the record is not in use, but upgrading is still sensible.
Also check whether the server is reachable from outside your network, since no login is needed.
What to do now
- Upgrade TinyWeb to 1.98 or later.
- If you cannot upgrade, remove or disable all CGI scripts from the cgi-bin directory, as the advisory suggests.
- Put the server behind a firewall or reverse proxy that limits who can reach it.
- Run the process under a low privilege Windows account, not an administrator.
- Review web server logs for query strings with unusual characters sent to CGI paths.
- Move any internet facing use to a maintained web server where you can.
Why it matters
The weakness is CWE-78, OS command injection. Per the record, the query parameters of an ISINDEX style request are passed as command line arguments to the CGI executable through the Windows CreateProcess call. Windows shell metacharacters in the request are not neutralised, so an attacker can add their own commands.
The vector shows network access, low complexity, no privileges and no user interaction, with high impact on all three axes. That is the profile of a flaw that can be found and used by automated scanning.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list. The project author published a write up linked from the record. The lesson reaches beyond this server: any code that builds a process command line from request data needs strict validation or an argument list that never passes through a shell.
Quick check
Do I need CGI scripts for the flaw to matter?
The record ties the flaw to CGI handling. The advisory workaround is to remove or disable all CGI scripts, which means no CGI means the path is closed.
Which version fixes it?
1.98, released on 23 November 2025 according to the advisory.
Does an attacker need credentials?
No. The record calls the attacker unauthenticated and remote.
Sources
Last reviewed: 19 October 2026.
