CVE-2026-34114
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The vulnerability in the Guardian language system involves passing the 'id' GET parameter directly into a PHP exec() call in translate_text.php without sanitization. No authentication is required, allowing an unauthenticated remote attacker to execute arbitrary OS commands.
Risk Assessment
The risk for the organization includes full server compromise by an unauthenticated attacker, potentially leading to data theft, malware installation, or service disruption.
Recommendation
Immediately update the Guardian system to the latest version that fixes this vulnerability and apply input sanitization to all parameters passed to exec() functions.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/translate_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.