CVE-2026-2761310.0CriticalCWE-78

CVE-2026-27613: CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)

maximmasiutin · TinyWeb

Affected: maximmasiutin TinyWeb · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.9%probability of exploitation in the next 30 days

59th percentile

050100

Higher than 59% of scored CVEs

10.0CriticalCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the specific CGI executable in use, the impact is either source code disclosure or remote code execution (RCE). Anyone hosting CGI scripts (particularly interpreted languages like PHP) using vulnerable versions of TinyWeb is impacted. The problem has been patched in version 2.01. If upgrading is not immediately possible, ensure `STRICT_CGI_PARAMS` is enabled (it is defined by default in `define.inc`) and/or do not use CGI executables that natively accept dangerous command-line flags (such as `php-cgi.exe`). If hosting PHP, consider placing the server behind a Web Application Firewall (WAF) that explicitly blocks URL query string parameters that begin with a hyphen (`-`) or contain encoded double quotes (`%22`).

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

maximmasiutin · TinyWeb< 2.01

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: OS Command Injection · Command and Code Injection
Vendor: maximmasiutin
Published: February 2026
Band: Unlikely (under 1%), February 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-27613 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.