CVE-2026-34108: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$loginsession.\" \".$GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34108?
The severity of CVE-2026-34108 is critical with a score of 9.3.
What type of vulnerability is CVE-2026-34108?
CVE-2026-34108 is an OS Command Injection vulnerability in the Guardian language-system.
How does CVE-2026-34108 allow exploitation?
CVE-2026-34108 allows exploitation through the unauthenticated manipulation of the id GET parameter in the text.php file.
What impact does CVE-2026-34108 have on the system?
CVE-2026-34108 can allow an unauthenticated remote attacker to execute arbitrary commands on the server.
How can I fix CVE-2026-34108?
To fix CVE-2026-34108, sanitize and validate the id parameter before passing it to the exec() function in text.php.