CVE-2026-34109
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' GET parameter passed directly to the PHP exec() function in speech.php.
Risk Assessment
An attacker can fully compromise the server, steal data, install malware, or disrupt service, posing a critical threat to the confidentiality, integrity, and availability of the system.
Recommendation
Immediately update Guardian to the latest patched version, implement input validation and sanitization for all data passed to exec(), and consider using safer alternatives like escapeshellarg().
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.