Description
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Published: 2026-07-01
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Guardian language‑system’s speech.php passes the id GET parameter directly into a PHP exec() call without sanitization. This flaw satisfies CWE‑78 and allows an unauthenticated attacker to inject shell metacharacters, resulting in arbitrary OS command execution that can compromise the confidentiality, integrity, and availability of the affected server.

Affected Systems

All installations of Guardian Language‑System are potentially impacted. No specific product versions are disclosed, so the vulnerability applies until the vendor releases a fix.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. With an EPSS score of <1 % the current likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via unauthenticated HTTP requests to speech.php, requiring no credentials and only the ability to send a crafted id parameter. This path enables arbitrary command execution on the host.

Generated by OpenCVE AI on August 1, 2026 at 23:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Contact Guardian and apply an official patch or update that sanitizes or removes the exec() usage in speech.php.
  • Configure firewalls or network segmentation to restrict access to speech.php so that only trusted internal hosts or authenticated users can reach the endpoint.
  • If no patch is available, modify speech.php to validate the id parameter (for example, allow only numeric values) or comment out the exec() call until a proper fix is released.

Generated by OpenCVE AI on August 1, 2026 at 23:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Guardian
Guardian language-system
Vendors & Products Guardian
Guardian language-system

Wed, 01 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Title Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Guardian Language-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-14T18:40:21.626Z

Reserved: 2026-03-25T18:43:09.827Z

Link: CVE-2026-34109

cve-icon Vulnrichment

Updated: 2026-07-01T17:45:23.522Z

cve-icon NVD

Status : Deferred

Published: 2026-07-01T17:16:34.107

Modified: 2026-07-14T19:17:00.503

Link: CVE-2026-34109

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T23:15:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')