Which versions of Guardian language-system are affected by CVE-2026-34115?

Guardian language-system contains a critical unauthenticated remote code execution vulnerability (CVE-2026-34115, CVSS 9.3).

How to fix or mitigate CVE-2026-34115?

Within 24 hours: Identify all Guardian language-system deployments, disable the transcribe_amazon.php endpoint, and assess network exposure of affected systems. Within 7 days: Deploy WAF rules blocking command injection metacharacters (;|`$) in the id parameter, implement strict input validation and output encoding before PHP exec() execution, and configure the web server process to run with minimal required privileges. Within 30 days: Monitor vendor for patch release, validate effectiveness of compensating controls through penetration testing, and establish backup transcription service or evaluate product replacement if patch not released within 90 days.

Guardian language-system CVE-2026-34115

Q: What is the CVSS score of CVE-2026-34115?

CVE-2026-34115 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41074 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-vqvm-84q3-93x8

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable endpoint with trivial injection gives AV:N/AC:L/PR:N/UI:N; shell-level RCE as the web-server user yields full C:H/I:H/A:H, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:33 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/transcribe_amazon.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

OS command injection in Guardian language-system's transcribe_amazon.php allows an unauthenticated remote attacker to run arbitrary operating-system commands on the host. The id GET parameter is concatenated directly into a PHP exec() call that shells out to a transcription job, so appending shell metacharacters (e.g. ; | `) yields command execution with the privileges of the web server. No authentication or user interaction is required (PR:N/UI:N), and a public gist reference exists that may contain proof-of-concept details, though active exploitation is not confirmed in CISA KEV.

Technical ContextAI

The affected component is a PHP web application (Guardian language-system) that integrates with Amazon Transcribe for speech-to-text jobs. At transcribe_amazon.php line 15 the code builds a shell command by string concatenation - exec("php jobs/transcribe_amazon.php ".$login_session." ".$_GET['id']." ...") - and passes user-controlled input from $_GET['id'] straight to exec() with no escaping (no escapeshellarg/escapeshellcmd) and no input validation. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection): because exec() invokes a system shell, metacharacters such as semicolons, pipes, backticks, and $() are interpreted by the shell rather than treated as literal data, letting the attacker break out of the intended 'php jobs/...' command and chain their own commands.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so remediation must rely on compensating controls until the vendor issues a fix; consult the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-transcribe-amazon-php) for updates. The correct code-level fix is to stop passing user input into a shell: validate that the id parameter is strictly numeric (or the expected job-id format) and wrap it with escapeshellarg(), or replace exec() with an argument-array invocation that does not spawn a shell. As interim controls, restrict network access to transcribe_amazon.php via web-server ACLs or a WAF rule blocking shell metacharacters (; | & ` $ ( ) newlines) in the id parameter - trade-off: WAF filtering can be bypassed and may break legitimate ids containing special characters; alternatively, disable or remove the Amazon transcription endpoint if the feature is unused - trade-off: loss of transcription functionality; and run the PHP worker under a least-privileged, sandboxed account to limit blast radius if the injection is triggered.