CVE-2026-34107: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php
Published Jul 1, 2026
·Updated
Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate.php \".$loginsession.\" \".$GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Affected Software
1 affected component
Guardian Language-System
Event History
Jul 1, 2026
CVE Published
via MITRE·04:16 PM
Data Sourced
via MITRE·04:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-34107?
CVE-2026-34107 has a critical severity rating of 9.8.
2
How do I fix CVE-2026-34107?
To fix CVE-2026-34107, sanitize the id GET parameter before using it in the exec() call.
3
What type of vulnerability is represented by CVE-2026-34107?
CVE-2026-34107 is an OS Command Injection vulnerability.
4
Who is affected by CVE-2026-34107?
CVE-2026-34107 affects users of the Guardian Language-System.
5
Can an attacker exploit CVE-2026-34107 remotely?
Yes, an unauthenticated remote attacker can exploit CVE-2026-34107 due to lack of authentication.