Which versions of Guardian Language System are affected by CVE-2026-34112?

Guardian language-system's speechmac.php contains a critical OS command injection vulnerability (CVE-2026-34112, CVSS 9.3) that allows unauthenticated remote attackers to execute arbitrary…

How to fix or mitigate CVE-2026-34112?

Within 24 hours: Inventory all Guardian installations and identify those accessible from untrusted networks; conduct forensic review of access logs for exploitation indicators. Within 7 days: Implement network segmentation to restrict access to Guardian instances; disable or restrict the vulnerable speechmac.php endpoint; deploy WAF rules to filter shell metacharacters in the 'id' parameter. Within 30 days: Establish vendor patch timeline; evaluate migration to patched Guardian version or alternative product.

Guardian Language System CVE-2026-34112

Q: What is the CVSS score of CVE-2026-34112?

CVE-2026-34112 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41070 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-4w55-hwr7-pf5h

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated remote request with trivial complexity reaches exec(), giving full command execution, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged as impact stays on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:30 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

OS command injection in the Guardian language-system's speechmac.php enables unauthenticated remote attackers to run arbitrary operating-system commands by injecting shell metacharacters into the 'id' GET parameter, which is concatenated directly into a PHP exec() call. No credentials or user interaction are required, so any network-reachable instance can be fully compromised. This is a CWE-78 flaw carrying a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis, though a referenced gist may contain proof-of-concept material.

Technical ContextAI

The vulnerability lives in a PHP web application ('Guardian language-system') that invokes a backend speech-audio job by shelling out via PHP's exec() function. At speechmac.php line 18 the code builds the command string exec("php jobs/speech_audio_mac.php ".$login_session." ".$_GET['id']." ..."), interpolating the attacker-controlled 'id' request parameter with no escaping, escapeshellarg(), or input validation. Because exec() hands the assembled string to the system shell (/bin/sh -c), shell metacharacters such as ;, |, &&, $(), or backticks break out of the intended argument context. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No exact CPE was published in the source data, so the affected component is identified by the vendor/product name and vulnerable file path rather than a formal CPE string.

RemediationAI

No vendor-released patch identified at time of analysis, so no exact fix version can be cited. The definitive code-level fix is to stop passing the 'id' parameter into a shell: replace exec() with a call that does not invoke the shell, validate 'id' against a strict allowlist (e.g. numeric-only), and wrap any external argument in escapeshellarg(). Until a patched build is available, the most effective compensating control is to block or tightly restrict access to speechmac.php at the web server or WAF - for example returning 403 for that path or adding a WAF rule that rejects requests whose 'id' parameter contains shell metacharacters (;, |, &, $, backtick, newline), accepting the trade-off that legitimate speech-audio jobs may break. Alternatively restrict the application to trusted networks/VPN and place it behind authentication, understanding this does not fix the underlying code and only reduces exposure. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-speechmac-php) for authoritative guidance.