CVE-2026-34108
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the id parameter, which is passed unsanitized to the exec() function in text.php.
Risk Assessment
An attacker can gain full control of the server, steal data, install malware, or use the server for further attacks, posing a critical threat to the confidentiality, integrity, and availability of the system.
Recommendation
Immediately update Guardian to the latest patched version or apply a temporary fix by validating and sanitizing the id parameter before passing it to the exec() function.
Other vulnerabilities in Guardian
See all- CVE-2026-34116Critical
A vulnerability in the Guardian language system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the 'id' parameter in transcribe.php. The parameter is passed directly to the PHP exec() function without any sanitization.
- CVE-2026-34114Critical
The vulnerability in the Guardian language system involves passing the 'id' GET parameter directly into a PHP exec() call in translate_text.php without sanitization. No authentication is required, allowing an unauthenticated remote attacker to execute arbitrary OS commands.
- CVE-2026-34113Critical
A vulnerability in the Guardian language-system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the id parameter in speech_text.php.
- CVE-2026-34109Critical
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' GET parameter passed directly to the PHP exec() function in speech.php.
- CVE-2026-34106Critical
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' parameter in subtitles.php. The parameter is passed directly to the PHP exec() function without any sanitization.
- CVE-2026-55735High
Improper Verification of Cryptographic Signature in guardian (versions from 1.0.0 before 2.4.1) allows an unauthenticated attacker to revoke a victim's session with a forged JWT token.
- CVE-2026-55734High
A vulnerability in the Guardian library (Guardian.Permissions module) allows a denial of service attack via BEAM atom-table exhaustion. The encode_permissions!/1 function converts map keys to atoms without validation, and atoms are never garbage collected, exhausting the fixed-size atom table.
- CVE-2026-55733High
A vulnerability in the Guardian library (Elixir) allows DoS via unbounded atom creation from attacker-controlled binary input. The encode/3 function in Guardian.Permissions.AtomEncoding calls String.to_atom/1 without validation, exhausting the BEAM atom table and crashing the node.
- CVE-2026-54894High
Allocation of Resources Without Limits or Throttling in guardian (versions from 0.1.0 before 2.4.1) allows denial of service via unbounded atom creation from attacker-influenced binary input.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS