CVE-2026-34106: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitlerendering.php \".$loginsession.\" \".$GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34106?
The severity of CVE-2026-34106 is critical, rated at 9.8 on the CVSS scale.
How do I fix CVE-2026-34106?
To fix CVE-2026-34106, sanitize the input from the id GET parameter before using it in the exec() call in subtitles.php.
What type of vulnerability is CVE-2026-34106?
CVE-2026-34106 is classified as an OS Command Injection vulnerability.
What impact does CVE-2026-34106 have?
CVE-2026-34106 allows an unauthenticated remote attacker to execute arbitrary commands on the server.
Is authentication required to exploit CVE-2026-34106?
No, no authentication is required to exploit CVE-2026-34106, making it more dangerous.