Which versions of Guardian language-system are affected by CVE-2026-34109?

Guardian language-system is vulnerable to a critical unauthenticated remote code execution flaw (CVE-2026-34109) that allows attackers to gain complete control of affected servers through injection…

How to fix or mitigate CVE-2026-34109?

Within 24 hours: Restrict network access to speech.php or disable Guardian language-system features if operationally feasible; deploy Web Application Firewall (WAF) rules to block shell metacharacters in the 'id' GET parameter. Within 7 days: Conduct forensic audit of access logs to speech.php for exploitation indicators; implement network segmentation to isolate Guardian infrastructure from critical systems and data. Within 30 days: Monitor Guardian vendor security advisories for patched release; plan and execute upgrade to patched version immediately upon availability.

Guardian language-system CVE-2026-34109

Q: What is the CVSS score of CVE-2026-34109?

CVE-2026-34109 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41067 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-f5vf-w6pf-3mgf

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated remote GET parameter injected into exec() with no user interaction gives AV:N/AC:L/PR:N/UI:N; direct OS command execution yields full C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:31 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

OS command injection in the Guardian language-system lets an unauthenticated remote attacker run arbitrary shell commands by injecting metacharacters into the 'id' GET parameter, which speech.php passes unsanitized into a PHP exec() call. Rated CVSS 4.0 9.3 (Critical) with a fully remote, no-privilege, no-interaction vector, this is a direct pre-auth RCE. No CISA KEV listing or EPSS score is present in the provided data, and no confirmed public exploit is identified, though a referenced GitHub gist and a VulnCheck advisory document the flaw.

Technical ContextAI

The affected component is a PHP web application ('Guardian language-system') that provides text-to-speech job handling. In speech.php line 18, the code builds a shell command string - exec("php jobs/speech_audio.php ".$login_session." ".$_GET['id']." ...") - by concatenating the attacker-controlled 'id' request parameter directly into the command line with no escaping or validation. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Because PHP's exec() invokes the system shell (/bin/sh), any shell metacharacter in 'id' (;, |, &&, backticks, $() ) breaks out of the intended 'php jobs/speech_audio.php ...' invocation and runs attacker commands in the context of the web server user. No CPE strings were supplied, so exact affected version identifiers cannot be enumerated from the input.

RemediationAI

No vendor-released patch version is identified at time of analysis, so no fixed version can be cited. The correct code-level fix is to stop passing user input into a shell: replace the exec() concatenation in speech.php with a call that avoids the shell and passes 'id' as a separate, validated argument (e.g. escapeshellarg() on the value, or better, strict input validation restricting 'id' to an integer/whitelist), since the parameter is evidently intended to be a numeric job identifier. As an immediate compensating control, restrict or block network access to the speech.php endpoint at the reverse proxy or WAF and reject any 'id' value containing non-numeric or shell metacharacters (; | & ` $ ( ) newline) - the trade-off is that legitimate non-integer identifiers, if any, would break, so validate the expected format first. If the feature is non-essential, disable the speech/audio job route entirely until a fix is deployed. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-speech-php) for vendor guidance and monitor for a released patched version.