CVE-2026-27613 is a critical flaw (CVSS 9.8) in TinyWeb, a Delphi web server for Windows. Unauthenticated remote users can bypass its CGI parameter controls, which exposes script source or allows command execution depending on setup. Upgrade to TinyWeb 2.01, or apply the vendor mitigations.
What's affected
TinyWeb versions before 2.01. The impact depends on what the server hosts. The advisory says anyone running CGI scripts, particularly interpreted languages such as PHP, on a vulnerable version is affected.
The advisory describes two outcomes. With the default strict parameter setting, a query parameter beginning with a hyphen can expose the highlighted source of a PHP script. With that setting off, escaping differences can let an attacker pass extra command line flags to the CGI program, which results in remote code execution.
How to check if you're exposed
Find the TinyWeb build, check whether it hosts CGI, and look at your configuration.
- Check the file version of the TinyWeb executable on the Windows host.
- Look for CGI executables such as php-cgi.exe under the server's CGI mapping.
- Check whether
STRICT_CGI_PARAMSis defined indefine.incin your build. The advisory says it is defined by default.
If you do not host CGI at all, this flaw does not apply.
What to do now
- Upgrade to TinyWeb 2.01.
- If you cannot upgrade, make sure
STRICT_CGI_PARAMSis enabled, which is the default indefine.inc. - Avoid CGI executables that natively accept dangerous command line flags, such as php-cgi.exe.
- If you host PHP, put a web application firewall in front that blocks query strings with parameters beginning with a hyphen or containing encoded double quotes (%22), as the vendor suggests.
- Review access logs for query strings starting with a hyphen.
Why it matters
The record lists OS command injection, CWE-78, and argument injection, CWE-88. A web server turns parts of a URL into the command line of another program. If the server and the program disagree on what counts as one argument, an attacker can add arguments of their own.
The patch rejects parameters that begin with a hyphen, following the CGI specification, and fixes the way double quotes are escaped for programs built with the Microsoft runtime. The two mitigations in the advisory map to the two outcomes: keep strict parameters on, and avoid programs with powerful command line switches.
Small embedded and legacy web servers are easy to forget in asset inventories. This is a prompt to look for them.
Quick check
Is a WAF a full fix?
No. It is the vendor's suggested stopgap when upgrading is not possible. The fix is TinyWeb 2.01.
Sources
Last reviewed: 19 October 2026.
