CVE-2026-34108
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the id parameter, which is passed unsanitized to the exec() function in text.php.
Risk Assessment
An attacker can gain full control of the server, steal data, install malware, or use the server for further attacks, posing a critical threat to the confidentiality, integrity, and availability of the system.
Recommendation
Immediately update Guardian to the latest patched version or apply a temporary fix by validating and sanitizing the id parameter before passing it to the exec() function.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.