CVE-2026-34114: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate_text.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in translatetext.php (line 18) without sanitization: exec(\"php jobs/translatetext.php \".$loginsession.\" \".$GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34114?
CVE-2026-34114 has a severity rating of critical at 9.8.
How do I fix CVE-2026-34114?
To fix CVE-2026-34114, sanitize the input being passed to the exec() function in translate_text.php to prevent OS command injection.
What type of attack is associated with CVE-2026-34114?
CVE-2026-34114 is associated with unauthenticated OS command injection attacks.
What software is affected by CVE-2026-34114?
The affected software is the Guardian Language-System.
Can an attacker exploit CVE-2026-34114 without authentication?
Yes, an attacker can exploit CVE-2026-34114 without any authentication.