A flaw in TinyWeb before version 2.01 allows an unauthenticated attacker to bypass the server’s CGI parameter filtering, enabling the injection of arbitrary command-line arguments or credentials. Depending on the CGI executable used and the server configuration, the attacker may obtain source code or execute arbitrary commands on the host system. The vulnerability arises from missing validation of CGI parameters, in particular the inability to enforce STRICT_CGI_PARAMS and improper handling of EscapeShellParam escaping.

All installations of TinyWeb by Maxim Masutin (RITLabs) running versions earlier than 2.01 are affected. The problem was resolved in release 2.01. Users running a web server that hosts CGI scripts—especially interpreted languages such as PHP—are at risk.

The CVSS score of 10 indicates the highest severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only an HTTP request containing specially crafted CGI parameters; an attacker does not need authentication or elevated privileges. The attack surface is remote and can target any accessible TinyWeb instance vulnerable to this bypass.