Vulnerability · Published Jul 1, 2026 · Assigned by VulnCheck

CVE-2026-34106Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php

Critical 9.8

In plain English

A critical-severity OS command injection in language-system from guardian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.9%top 39.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.

Affected products (as reported)

Vendor	Product	Versions
guardian	language-system	0 – through e42c395ec4b03fe62973a669c9209a673838b8a4

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-subtitles-php third-party-advisory