CVE-2026-34116: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe.php
Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcribe.php \".$loginsession.\" \".$GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34116?
CVE-2026-34116 has a critical severity rating of 9.8.
How do I fix CVE-2026-34116?
To fix CVE-2026-34116, sanitize the id parameter before using it in the exec() function to prevent command injection.
What type of vulnerability is CVE-2026-34116?
CVE-2026-34116 is categorized as an OS Command Injection vulnerability.
Can CVE-2026-34116 be exploited remotely?
Yes, CVE-2026-34116 can be exploited remotely by an unauthenticated attacker.
What is the impact of exploiting CVE-2026-34116?
Exploiting CVE-2026-34116 can allow an attacker to execute arbitrary commands on the server.