Which versions of Guardian language-system are affected by CVE-2026-34107?

Guardian language-system contains a critical remote code execution vulnerability in translate.php that allows unauthenticated attackers to execute arbitrary system commands.

Is there a public PoC exploit available for CVE-2026-34107?

Yes, a public proof-of-concept exploit is available for CVE-2026-34107. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-34107?

Within 24 hours: Identify all Guardian language-system instances; block network access to translate.php via firewall or WAF rules; audit system logs for unauthorized command execution. Within 7 days: Implement input validation to reject shell metacharacters in the 'id' parameter, or disable translate.php entirely if non-critical. Within 30 days: Monitor Guardian vendor security advisories for patch release; apply immediately upon availability and test in staging before production deployment.

Guardian language-system CVE-2026-34107

Q: What is the CVSS score of CVE-2026-34107?

CVE-2026-34107 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-41064 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 VulnCheck

GHSA-qp96-wjq3-2qcj

PHP Command Injection Guardian Language System

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable endpoint with trivial injection (AV:N/AC:L/PR:N/UI:N) yielding shell command execution, giving full C/I/A impact on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:51 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

OS command injection in Guardian language-system lets unauthenticated remote attackers run arbitrary shell commands by injecting metacharacters into the 'id' GET parameter of translate.php, which is concatenated directly into a PHP exec() call. Publicly available exploit code exists (published as a gist via VulnCheck), and the CVSS 4.0 base score of 9.3 reflects full compromise of confidentiality, integrity, and availability with no authentication or user interaction. There is no public exploit identified as actively exploited in CISA KEV, so the current risk is driven by ease of exploitation and public PoC rather than confirmed in-the-wild abuse.

Technical ContextAI

The affected component is the translation subsystem of Guardian language-system, a PHP web application. At translate.php line 14 the code builds a shell command string - exec("php jobs/translate.php ".$login_session." ".$_GET['id']." ...") - concatenating the attacker-controlled 'id' request parameter directly into the command passed to PHP's exec(). Because exec() invokes the command through the system shell, any shell metacharacters (;, |, &&, $(), backticks) in 'id' are interpreted by the shell rather than treated as a literal argument. This is the classic root cause of CWE-78 (Improper Neutralization of Special Elements used in an OS Command / 'OS Command Injection'): untrusted input reaching a command interpreter without sanitization, escaping, or use of argument-safe APIs. The single known affected product is identified by CPE cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch version was identified at time of analysis, so no exact fix version can be cited. The definitive fix is a code change: stop passing $_GET['id'] into exec() unsanitized - either validate 'id' against a strict allowlist (for example, enforce that it is an integer via ctype_digit or an (int) cast), or use escapeshellarg() on the value, and prefer argument-safe process APIs over shell string concatenation. As immediate compensating controls until a fixed build is available: restrict network access to translate.php via web-server rules or a WAF (for example, block requests where the 'id' parameter contains shell metacharacters such as ;, |, &, $, backticks, or spaces), place the application behind authentication or an IP allowlist, and consider disabling the language/translation feature that invokes jobs/translate.php if it is not required - the trade-off being loss of translation-job functionality. Also constrain the PHP process's OS privileges and use PHP disable_functions to block exec/shell_exec/system where the application does not legitimately need them, accepting that this may break other features that rely on shelling out. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-translate-php) for updates and any vendor fix.