Guardian language-system CVE-2026-34113

Q: What is the CVSS score of CVE-2026-34113?

CVE-2026-34113 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41071 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-fc8h-wr46-7v25

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated HTTP parameter flows into shell exec with no interaction (AV:N/AC:L/PR:N/UI:N); arbitrary command execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Jul 01, 2026 - 17:40 cve.org

CRITICAL 9.3

Analysis Generated

Jul 01, 2026 - 17:32 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

Unauthenticated OS command injection in Guardian language-system's speech_text.php allows remote attackers to execute arbitrary shell commands by injecting metacharacters into the id GET parameter, which is passed unsanitized into a PHP exec() call. No authentication is required (CVSS 4.0 base 9.3), giving full read/write/availability impact on the host. A referenced GitHub gist and a VulnCheck advisory document the flaw, indicating publicly available exploit details, though it is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a classic CWE-78 (OS Command Injection) in a PHP web application. In speech_text.php line 18, user-controlled input from $_GET['id'] is concatenated directly into a shell command string - exec("php jobs/speech_audio_text.php ".$login_session." ".$_GET['id']." ...") - and handed to the OS shell via exec(). Because PHP's exec() invokes /bin/sh, shell metacharacters (; | & $() backticks) in the id value break out of the intended argument and are interpreted as additional commands, running with the privileges of the web server / PHP process. The application performs a speech-audio-to-text batch job, and the id parameter is meant to reference a job record but is never validated, escaped (e.g. via escapeshellarg), or type-cast to an integer. No CPE strings were provided in the intelligence, so exact affected version enumeration is not available from NVD data.

RemediationAI

No vendor-released patch version was identified in the provided data, so no exact fix version can be cited; monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-speech-text-php) for an upstream fixed release. As an immediate code-level fix, the id parameter should be cast to an integer or wrapped with escapeshellarg() before being placed in the exec() call, and ideally the exec() call should be replaced with a non-shell invocation. As compensating controls until a patch is available: restrict access to speech_text.php at the web server or WAF layer (deny external requests, allowlist internal callers only) since this endpoint should not be reachable by anonymous users; add a WAF/input-filter rule rejecting shell metacharacters (; | & ` $ ( )) and non-numeric values in the id parameter, accepting the trade-off that overly strict filters may block legitimate job IDs; and run the PHP/web process under a least-privileged account with a restricted shell to limit blast radius, noting this reduces impact but does not prevent exploitation. If the speech-to-text feature is non-essential, disabling the speech_text.php job endpoint entirely removes the attack surface at the cost of that functionality.