What is the CVSS score of CVE-2026-27613?

CVE-2026-27613 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27613?

A critical vulnerability in TinyWeb versions prior to 2.01 allows attackers to bypass security controls and inject malicious parameters without authentication, potentially leading to unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-27613?

Within 24 hours: Identify all systems running TinyWeb and determine current version; isolate or disable affected instances if upgrade cannot be completed immediately. Within 7 days: Apply vendor patch to upgrade TinyWeb to version 2.01 or later on all affected systems and conduct validation testing. Within 30 days: Complete inventory audit of all TinyWeb deployments, implement access controls restricting web server exposure, and deploy network monitoring to detect exploitation attempts.

PHP CVE-2026-27613

CRITICAL

OS Command Injection (CWE-78)

2026-02-25 security-advisories@github.com

PHP RCE Tinyweb

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 04, 2026 - 03:21 nvd

Patch available

CVE Published

Feb 25, 2026 - 23:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the specific CGI executable in use, the impact is either source code disclosure or remote code execution (RCE). Anyone hosting CGI scripts (particularly interpreted languages like PHP) using vulnerable versions of TinyWeb is impacted. The problem has been patched in version 2.01. If upgrading is not immediately possible, ensure STRICT_CGI_PARAMS is enabled (it is defined by default in define.inc) and/or do not use CGI executables that natively accept dangerous command-line flags (such as php-cgi.exe). If hosting PHP, consider placing the server behind a Web Application Firewall (WAF) that explicitly blocks URL query string parameters that begin with a hyphen (-) or contain encoded double quotes (%22).

AnalysisAI

Unauthenticated command injection in TinyWeb HTTP/HTTPS server for Win32 before 2.01 allows remote attackers to execute arbitrary commands. Patch available.