What is the CVSS score of CVE-2026-22781?

CVE-2026-22781 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Windows are affected by CVE-2026-22781?

Organizations using Delphi for Win32. TinyWeb HTTP Server face critical risk from CVE-2026-22781, a OS command injection vulnerability rated CVSS 9.8.. A patch is available.

How to fix or mitigate CVE-2026-22781?

Within 24 hours: Identify all affected systems running Delphi for Win32. TinyWeb HTTP Server and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Windows CVE-2026-22781

CRITICAL

OS Command Injection (CWE-78)

2026-01-12 security-advisories@github.com

Windows Command Injection Tinyweb Ritlabs

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 16, 2026 - 18:44 nvd

Patch available

CVE Published

Jan 12, 2026 - 19:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

AnalysisAI

TinyWeb HTTP Server before 1.98 has OS command injection via CGI ISINDEX query parameters. The query string is passed as command-line arguments to CGI executables through Windows CreateProcess(), allowing unauthenticated RCE. Patch available.

Technical ContextAI

ISINDEX-style query parameters are passed as command-line arguments to CGI programs via Windows CreateProcess() (CWE-78). An attacker can inject Windows shell metacharacters to execute arbitrary commands alongside the intended CGI invocation.