Which versions of Guardian language-system are affected by CVE-2026-34117?

Guardian language-system PHP application contains a critical unauthenticated remote code execution vulnerability enabling any internet-facing instance to be fully compromised without authentication…

How to fix or mitigate CVE-2026-34117?

24 hours: Identify all Guardian installations reachable from the internet; immediately restrict network access to text_to_subtitles.php via firewall rules or temporary service shutdown. 7 days: Deploy Web Application Firewall rules to block requests with shell metacharacters in the 'id' GET parameter; enable application-level request logging and alerting; implement strict input validation (alphanumeric-only allowlist if operationally feasible). 30 days: Monitor Guardian vendor security advisories weekly for patch release; establish pre-tested deployment procedure to apply fix to all instances within 24 hours of availability.

Guardian language-system CVE-2026-34117

Q: What is the CVSS score of CVE-2026-34117?

CVE-2026-34117 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41076 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-xv4q-rvqg-wpq7

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable endpoint (AV:N/PR:N/UI:N), trivial metacharacter injection (AC:L), and shell code execution yielding full host compromise (C:H/I:H/A:H); scope unchanged as code runs in the web process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:34 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization: exec(\"php jobs/text_to_subtitles.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

Unauthenticated OS command injection in the Guardian language-system PHP application lets remote attackers run arbitrary operating-system commands by injecting shell metacharacters into the 'id' GET parameter of text_to_subtitles.php, which is concatenated directly into a PHP exec() call. Any internet-reachable instance can be fully compromised without credentials or user interaction, and the CVSS 4.0 base score of 9.3 reflects full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, though a VulnCheck advisory and a technical gist describe the exact vulnerable code path.

Technical ContextAI

The flaw is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) in a server-side PHP web application. At text_to_subtitles.php line 19 the code builds a shell command string - exec("php jobs/text_to_subtitles.php ".$login_session." ".$_GET['id']." ...") - by concatenating the untrusted $_GET['id'] value directly into the argument passed to PHP's exec(), which invokes a system shell (/bin/sh). Because no escaping (e.g. escapeshellarg/escapeshellcmd), type-casting, or allow-listing is applied, shell metacharacters such as ;, |, &&, backticks, or $() break out of the intended 'php jobs/...' invocation and are interpreted by the shell, running as the web server / PHP process user. The reference to a job-runner script that converts text to subtitles indicates a media/localization tooling context where the endpoint is expected to be triggered programmatically.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so no exact upgrade target can be cited. The definitive code-level fix is to stop passing $_GET['id'] into exec(): validate the id as a strict integer (e.g. cast with (int) or reject any non-numeric input) and, if a shell call is truly required, wrap the argument in escapeshellarg() - replacing exec() with a parameterized job dispatch avoids the shell entirely. As immediate compensating controls, restrict network access to text_to_subtitles.php via web-server ACLs, authentication, or a firewall/WAF rule so it is not reachable by anonymous clients (trade-off: may break legitimate automated subtitle jobs that call the endpoint), and add a WAF signature blocking shell metacharacters (;, |, &, backtick, $()) in the id parameter (trade-off: metacharacter filtering can be bypassed and may cause false positives). Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-text-to-subtitles-php) for vendor guidance and monitor for an official release.