CVE-2026-34113: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech_text.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechtext.php (line 18) without sanitization: exec(\"php jobs/speechaudiotext.php \".$loginsession.\" \".$GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34113?
The severity of CVE-2026-34113 is critical, with a CVSS score of 9.8.
How do I fix CVE-2026-34113?
To fix CVE-2026-34113, sanitize the 'id' parameter in the speech_text.php file to prevent OS command injection.
What type of vulnerability is CVE-2026-34113?
CVE-2026-34113 is classified as an OS Command Injection vulnerability.
Who is affected by CVE-2026-34113?
CVE-2026-34113 affects users of the Guardian Language-System that utilize the speech_text.php script.
Can an attacker exploit CVE-2026-34113 without authentication?
Yes, an unauthenticated remote attacker can exploit CVE-2026-34113 to execute commands on the server.