CVE-2026-27613— TinyWeb 参数注入漏洞

CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the specific CGI executable in use, the impact is either source code disclosure or remote code execution (RCE). Anyone hosting CGI scripts (particularly interpreted languages like PHP) using vulnerable versions of TinyWeb is impacted. The problem has been patched in version 2.01. If upgrading is not immediately possible, ensure `STRICT_CGI_PARAMS` is enabled (it is defined by default in `define.inc`) and/or do not use CGI executables that natively accept dangerous command-line flags (such as `php-cgi.exe`). If hosting PHP, consider placing the server behind a Web Application Firewall (WAF) that explicitly blocks URL query string parameters that begin with a hyphen (`-`) or contain encoded double quotes (`%22`).

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

TinyWeb 参数注入漏洞

TinyWeb是Konstantin Belyalov个人开发者的一个简单且轻量级 HTTP 服务器。 TinyWeb 2.01之前版本存在参数注入漏洞，该漏洞源于允许未经验证的远程攻击者绕过Web服务器的CGI参数安全控制，可能导致源代码泄露或远程代码执行。

N/A

N/A