Which versions of Guardian language-system are affected by EUVD-2026-41063?

Guardian language-system contains a critical remote code execution vulnerability (CVE-2026-34106) exploitable by unauthenticated attackers over the network with no user interaction required, allowing…

Is there a public PoC exploit available for EUVD-2026-41063?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41063. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate EUVD-2026-41063?

Within 24 hours: Identify all Guardian language-system instances and isolate from untrusted networks; implement WAF rules blocking shell metacharacters (|, &, $, `, ;) in subtitles.php 'id' parameter. Within 7 days: Disable or restrict subtitles.php to authenticated internal-only access; audit access logs for exploitation attempts. Within 30 days: Contact Guardian for emergency patch timeline or negotiate managed security service to monitor/isolate affected systems pending patched version.

Guardian language-system EUVD-2026-41063

Q: What is the CVSS score of EUVD-2026-41063?

EUVD-2026-41063 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2026-34106 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 VulnCheck

GHSA-hw82-rg7w-cx9p

PHP Command Injection Guardian Language System

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable GET parameter flows into a shell exec() with no interaction, giving low complexity and full C/I/A impact on the host; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:52 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.

AnalysisAI

Remote code execution in Guardian language-system allows unauthenticated attackers to run arbitrary OS commands by injecting shell metacharacters into the 'id' GET parameter of subtitles.php, which is concatenated directly into a PHP exec() call invoking jobs/subtitle_rendering.php. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation, and publicly available exploit code exists (published via VulnCheck), though there is no public exploit identified as being actively used in the wild at time of analysis.

Technical ContextAI

The affected component is subtitles.php in Guardian's PHP-based language/subtitle rendering system (cpe:2.3:a:guardian:language-system). At line 19 the application builds a shell command string - exec("php jobs/subtitle_rendering.php ".$login_session." ".$_GET['id']." ...") - and passes attacker-controlled input from $_GET['id'] straight to exec() without escapeshellarg(), escapeshellcmd(), or any input validation. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Because exec() spawns a shell, metacharacters such as ;, |, &, $(...), and backticks let the attacker break out of the intended 'php' argument context and append their own commands, which execute with the privileges of the web server / PHP process.

RemediationAI

No vendor-released patch or fixed version is identified in the available data at time of analysis, so the primary recommendation is to consult the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-subtitles-php) for vendor guidance and to apply any fixed release the vendor issues. As immediate compensating controls: restrict or block external access to subtitles.php at the web server or WAF layer (side effect - breaks the subtitle rendering feature for legitimate users if it is public-facing); add a WAF/input-filter rule rejecting the 'id' parameter unless it strictly matches an expected numeric/identifier pattern (side effect - may cause false negatives if the exploit uses encoding, so pair with strict allow-listing); and if you control the source, remediate at code level by replacing the raw concatenation with escapeshellarg($_GET['id']) plus server-side validation that 'id' is an integer. Run the PHP/web process under a least-privilege account to limit blast radius if injection succeeds.