TinyWeb, a Delphi-based web server, incorrectly parses HTTP header values and passes them to CGI scripts as environment variables. Because the parser does not reject dangerous control characters—such as CR, LF, and NUL—and fails to reject encoded forms (%0d, %0a, %00), an attacker can inject malformed header content that propagates into the CGI execution context. This manipulation can alter request processing, inject code or commands, and ultimately allow the execution of arbitrary code on the host running the web server. The flaw falls under several weaknesses including improper input validation and unsafe handling of environment data.

The vulnerability exists in all TinyWeb releases prior to version 2.04. The affected product, TinyWeb, is distributed by the developer Maxim Masutin. Clients running any pre‑2.04 build—regardless of minor patch levels—are susceptible until they apply the patch included in 2.04 or later.

The CVSS score of 9.2 indicates a high‑severity threat, but the EPSS score of less than 1% suggests that active exploitation in the wild is currently unlikely. The vulnerability is reachable over the network through crafted HTTP requests, and it does not require local access or elevated privileges on the target system. The flaw is not listed in the CISA KEV catalog, but its potential for remote code execution warrants immediate attention.