CVE-2026-34110: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in complexstart.php (line 14) without sanitization: exec(\"php jobs/complex.php \".$loginsession.\" \".$GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34110?
CVE-2026-34110 has a severity score of 9.3, classified as critical.
What type of vulnerability is CVE-2026-34110?
CVE-2026-34110 is an OS command injection vulnerability.
How do I fix CVE-2026-34110?
To fix CVE-2026-34110, sanitize the id parameter before passing it to the exec() function in complex_start.php.
Who is affected by CVE-2026-34110?
Any user of the Guardian Language-System that executes the complex_start.php script with unsanitized input is affected by CVE-2026-34110.
What could an attacker do exploiting CVE-2026-34110?
An attacker can execute arbitrary commands on the server remotely by exploiting CVE-2026-34110.