CVE-2026-27613

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27613
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27613.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27613
Aliases
  • GHSA-rfx5-fh9m-9jj9
Published
2026-02-25T22:58:16.358Z
Modified
2026-03-03T02:56:35.902109Z
Severity
  • 10.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)
Details

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the specific CGI executable in use, the impact is either source code disclosure or remote code execution (RCE). Anyone hosting CGI scripts (particularly interpreted languages like PHP) using vulnerable versions of TinyWeb is impacted. The problem has been patched in version 2.01. If upgrading is not immediately possible, ensure STRICT_CGI_PARAMS is enabled (it is defined by default in define.inc) and/or do not use CGI executables that natively accept dangerous command-line flags (such as php-cgi.exe). If hosting PHP, consider placing the server behind a Web Application Firewall (WAF) that explicitly blocks URL query string parameters that begin with a hyphen (-) or contain encoded double quotes (%22).

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27613.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-78",
        "CWE-88"
    ]
}
References

Affected packages

Git / github.com/maximmasiutin/tinyweb

Affected ranges

Type
GIT
Repo
https://github.com/maximmasiutin/tinyweb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eda3063d7a10b6a37e3e567dc7be3369683d007c

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27613.json"