Which versions of Guardian Language-System are affected by CVE-2026-34116?

Guardian language-system contains an unauthenticated remote code execution vulnerability in transcribe.php that allows attackers to inject arbitrary OS commands without credentials or user…

How to fix or mitigate CVE-2026-34116?

Within 24 hours: Inventory all Guardian language-system deployments and confirm whether transcribe.php is network-accessible. Within 7 days: Implement network-level controls (WAF rules blocking requests with shell metacharacters in the 'id' parameter, access control lists restricting to trusted IPs) and validate input validation at the application layer. Within 30 days: Monitor vendor advisories for patch availability; evaluate upgrade to patched version or replacement solution if Guardian does not release a fix within 60 days.

Guardian Language-System CVE-2026-34116

Q: What is the CVSS score of CVE-2026-34116?

CVE-2026-34116 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41075 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-7899-78h3-4ggh

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Single unauthenticated GET request reaches a shell sink (AV:N/AC:L/PR:N/UI:N) yielding full command execution, so C/I/A all High; scope unchanged as impact stays within the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:33 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcribe.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

OS command injection in Guardian language-system's transcribe.php lets an unauthenticated remote attacker inject arbitrary shell commands through the 'id' GET parameter, which is concatenated directly into a PHP exec() call. Because no authentication or user interaction is required and the flaw yields full command execution, it maps to a CVSS 4.0 score of 9.3 with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, though a public gist writeup and a VulnCheck advisory document the issue.

Technical ContextAI

The vulnerability is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue in a PHP web application. At transcribe.php line 15 the application builds a shell command string by concatenating the attacker-controlled $_GET['id'] value into exec("php jobs/transcribe.php ".$login_session." ".$_GET['id']." ..."). Because exec() passes the assembled string to the system shell (/bin/sh -c), any shell metacharacter - semicolons, pipes, backticks, $(...), && - breaks out of the intended 'php jobs/transcribe.php' invocation and is interpreted as additional shell commands. The root cause is the absence of input validation, escapeshellarg()/escapeshellcmd() encoding, or use of a safe argument-array execution API. The affected component is a transcription job dispatcher within the Guardian language/transcription platform.

RemediationAI

No vendor-released patch identified at time of analysis, and no fix version is present in the provided data. As the primary code-level fix, sanitize or avoid shelling out entirely: validate that the 'id' parameter matches a strict allowlist (e.g. numeric-only, ^[0-9]+$) before use, and wrap it with escapeshellarg() - or better, replace exec() with an argument-array execution model (proc_open with a fixed argv) so parameters are never interpreted by a shell. As immediate compensating controls until an official patch ships, restrict network access to the transcribe.php endpoint via web-server ACLs or a WAF rule blocking shell metacharacters (; | & $ ` newline) in the id parameter - noting a WAF rule can be bypassed by encoding and should be treated as defense-in-depth, not a fix; and require authentication in front of the transcription functionality if the deployment allows it (trade-off: may break legitimate unauthenticated integrations). Monitor the VulnCheck advisory URL above for an official fixed release.