Which versions of Guardian language-system are affected by CVE-2026-34117?

Guardian language-system PHP application contains a critical unauthenticated remote code execution vulnerability enabling any internet-facing instance to be fully compromised without authentication…

How to fix or mitigate CVE-2026-34117?

24 hours: Identify all Guardian installations reachable from the internet; immediately restrict network access to text_to_subtitles.php via firewall rules or temporary service shutdown. 7 days: Deploy Web Application Firewall rules to block requests with shell metacharacters in the 'id' GET parameter; enable application-level request logging and alerting; implement strict input validation (alphanumeric-only allowlist if operationally feasible). 30 days: Monitor Guardian vendor security advisories weekly for patch release; establish pre-tested deployment procedure to apply fix to all instances within 24 hours of availability.

Guardian language-system CVE-2026-34117

Q: What is the CVSS score of CVE-2026-34117?

CVE-2026-34117 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41076 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-xv4q-rvqg-wpq7

Command Injection PHP

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable endpoint (AV:N/PR:N/UI:N), trivial metacharacter injection (AC:L), and shell code execution yielding full host compromise (C:H/I:H/A:H); scope unchanged as code runs in the web process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:34 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization: exec(\"php jobs/text_to_subtitles.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

Unauthenticated OS command injection in the Guardian language-system PHP application lets remote attackers run arbitrary operating-system commands by injecting shell metacharacters into the 'id' GET parameter of text_to_subtitles.php, which is concatenated directly into a PHP exec() call. Any internet-reachable instance can be fully compromised without credentials or user interaction, and the CVSS 4.0 base score of 9.3 reflects full confidentiality, integrity, and availability loss. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Locate exposed text_to_subtitles.php endpoint

Delivery

Send GET request with shell metacharacters in id

Exploit

Break out of exec() shell command

Execution

Execute arbitrary OS commands as web user

Impact

Deploy webshell and exfiltrate data