Which versions of Guardian Language System are affected by EUVD-2026-41073?

Guardian Language System installations face critical remote code execution through unauthenticated command injection in translate_text.php, enabling attackers to seize operational control without…

How to fix or mitigate EUVD-2026-41073?

24 hours: Conduct inventory of Guardian Language System deployments; isolate or disable translate_text.php endpoint; restrict network access to trusted sources only. 7 days: Deploy WAF rules blocking shell metacharacters in the 'id' parameter; implement network segmentation around affected systems. 30 days: Establish vendor patch timeline; conduct threat hunt on potentially compromised systems; develop migration plan to alternate translation solution.

Guardian Language System EUVD-2026-41073

Q: What is the CVSS score of EUVD-2026-41073?

EUVD-2026-41073 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-34114 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-9244-c487-2pc4

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated HTTP GET parameter injected into exec() gives network, low-complexity, no-privilege OS command execution with full C/I/A impact on the same host, so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:33 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/translate_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

OS command injection in Guardian Language System's translate_text.php allows unauthenticated remote attackers to execute arbitrary operating-system commands by injecting shell metacharacters into the 'id' GET parameter, which is concatenated directly into a PHP exec() call. Because no authentication is required and the CVSS 4.0 vector is AV:N/AC:L/PR:N/UI:N, exploitation is trivial and yields full command execution in the web server's context. There is no public exploit identified at time of analysis, though a VulnCheck advisory and a public gist document the flaw.

Technical ContextAI

The vulnerability stems from unsafe use of PHP's exec() function in translate_text.php (line 18), where user-controlled input from $_GET['id'] is passed unsanitized into a shell command string: exec("php jobs/translate_text.php ".$login_session." ".$_GET['id']." ..."). This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue: PHP's exec() invokes a system shell (/bin/sh -c), so shell metacharacters such as ; | & $() and backticks in the 'id' value are interpreted by the shell rather than treated as literal data. The affected component is a PHP-based language/translation subsystem (tagged 'PHP, Command Injection'); no CPE strings were supplied, so exact package identifiers are not available from the input.

RemediationAI

No vendor-released patch or fixed version was identified in the provided data, so a specific upgrade target cannot be cited. As the primary code-level fix, the vendor should stop passing $_GET['id'] into exec() and instead validate the parameter against a strict allowlist (e.g. enforce that 'id' is an integer via ctype_digit or an (int) cast) and use escapeshellarg()/escapeshellcmd() on any dynamic arguments. As immediate compensating controls, restrict or block external access to translate_text.php at the web server or WAF layer (deny requests where the 'id' parameter contains non-numeric characters such as ; | & $ ` or spaces), and place the endpoint behind authentication or an IP allowlist - the trade-off being that any legitimate unauthenticated translation callers would break. Monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-translate-text-php) for an official patched release before relying solely on workarounds.