CVE-2026-27613: Pascal Cgi Shell Escape Double Quote In Caret Setcve-2026-27613-pascal-cgi-shell-escape-double-quote-in-caret-set
A constant set of "dangerous" Windows shell metacharacters used for caret-prefix escaping ('^X') contains the double-quote character ('"'). Caret escaping is only honored by cmd.exe. Native Win32 binaries (e.g. php-cgi.exe and any CGI interpreter built with the MSVCRT runtime) parse their command line via CommandLineToArgvW, which only recognises '\"' as an