CVE-2026-22781
OS Command Injection in TinyWeb HTTP Server Before
Publication date: 2026-01-12
Last updated on: 2026-01-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| maxim_masiutin | tinyweb | to 1.98 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22781 is a critical OS command injection vulnerability in TinyWeb HTTP Server versions prior to 1.98. It occurs in the handling of CGI ISINDEX-style query parameters, which are passed as command-line arguments to CGI executables via Windows CreateProcess() without proper sanitization. An unauthenticated remote attacker can inject Windows shell metacharacters into HTTP requests, allowing arbitrary commands to be executed on the server. The vulnerability arises because unsafe query parameters are not properly validated or escaped, enabling command injection through crafted HTTP requests. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows an unauthenticated remote attacker to execute arbitrary OS commands on the TinyWeb server, leading to severe impacts such as full code execution, information disclosure, denial of service, and privilege escalation. Since the attack requires no privileges or user interaction, it poses a critical risk to the confidentiality, integrity, and availability of the affected system and potentially other connected systems. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the TinyWeb server's CGI scripts for ISINDEX-style query parameters containing suspicious Windows shell metacharacters such as &, |, <, >, ^, (, ), %, !, ", ', `, ;, $. For example, sending crafted HTTP requests like `GET /cgi-bin/script.exe?arg1&calc.exe HTTP/1.1` can test if the server executes injected commands. Network intrusion detection systems (NIDS) can be configured to alert on such suspicious query strings. Additionally, checking the TinyWeb server version to confirm if it is prior to 1.98 can help identify vulnerable instances. Specific commands to test might include using curl or wget to send requests with shell metacharacters in the query string, e.g.: `curl "http://target/cgi-bin/script.exe?arg1&calc.exe"` and observing if the command executes or causes unexpected behavior. [3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation steps are: 1) Upgrade TinyWeb to version 1.98 or later, which includes a fix implementing whitelist validation and shell metacharacter escaping to prevent command injection. 2) If upgrading is not feasible immediately, disable or remove all CGI scripts from the cgi-bin directory to prevent exploitation. These steps will reduce the risk of remote unauthenticated command execution via the vulnerable CGI query handling. [2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss the impact of CVE-2026-22781 on compliance with common standards and regulations such as GDPR or HIPAA. However, given that the vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the server, leading to potential information disclosure, integrity compromise, and denial of service, it could indirectly affect compliance by exposing sensitive data or disrupting service availability. Organizations using vulnerable versions of TinyWeb may face increased risk of data breaches or service interruptions, which are relevant concerns under regulations like GDPR and HIPAA. Mitigation by upgrading to TinyWeb 1.98 or disabling CGI scripts is recommended to reduce such risks. [2, 3]