CVE-2026-27613

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the specific CGI executable in use, the impact is either source code disclosure or remote code execution (RCE). Anyone hosting CGI scripts (particularly interpreted languages like PHP) using vulnerable versions of TinyWeb is impacted. The problem has been patched in version 2.01. If upgrading is not immediately possible, ensure `STRICT_CGI_PARAMS` is enabled (it is defined by default in `define.inc`) and/or do not use CGI executables that natively accept dangerous command-line flags (such as `php-cgi.exe`). If hosting PHP, consider placing the server behind a Web Application Firewall (WAF) that explicitly blocks URL query string parameters that begin with a hyphen (`-`) or contain encoded double quotes (`%22`).

• CWE-78
• CWE-88

• https://github.com/maximmasiutin/TinyWeb/commit/d9dbda8db49da69d2160e1c527e782b73b5ffb6bPatch
• https://github.com/maximmasiutin/TinyWeb/releases/tag/v2.01Release Notes
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-rfx5-fh9m-9jj9Vendor Advisory
• https://www.masiutin.net/tinyweb-cve-2026-27613.htmlThird Party Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27608Parse Dashboard is a standalone dashboard for managing Parse…8.1
• CVE-2026-27609Parse Dashboard is a standalone dashboard for managing Parse…6.5
• CVE-2026-2761Sandbox escape in the Graphics: WebRender component. This vu…10
• CVE-2026-27610Parse Dashboard is a standalone dashboard for managing Parse…5.3
• CVE-2026-27611FileBrowser Quantum is a free, self-hosted, web-based file m…6.5
• CVE-2026-27612Repostat is a React component to fetch and display GitHub re…6.1
• CVE-2026-27614Bugsink is a self-hosted error tracking tool. In versions pr…6.1
• CVE-2026-27615ADB Explorer is a fluent UI for ADB on Windows. In versions …7.8
• CVE-2026-27616Vikunja is an open-source self-hosted task management platfo…7.3
• CVE-2026-2762Integer overflow in the JavaScript: Standard Library compone…9.8
• CVE-2026-27621TypiCMS is a multilingual content management system based on…5.4
• CVE-2026-27622OpenEXR provides the specification and reference implementat…7.8