CVE-2026-34106
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' parameter in subtitles.php. The parameter is passed directly to the PHP exec() function without any sanitization.
Risk Assessment
An attacker can gain full control of the server, steal data, install malware, or use the server for further attacks within the internal network.
Recommendation
Immediately update Guardian to the latest patched version. If unavailable, temporarily disable subtitles.php or apply input filtering on the 'id' parameter.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.