PT-2026-54742 · Guardian · Language-System

Philopentest · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-34106

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec("php jobs/subtitle rendering.php ".$login session." ".$ GET['id']." ..."). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34106

Affected Products

Language-System

References · 3

• 🔥 https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34106 · Security Note
• https://vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-subtitles-php · Note