Description
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Published: 2026-07-01
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

vulnerability. The unsanitized 'id' GET parameter is concatenated directly into a PHP exec() call in speechmac_text.php, allowingacharacters and execute arbitrary operating‑system commands. The flaw is a classic CWE‑78 input‑validation weakness and requires no authentication.

Affected Systems

The vulnerability affects the Guardian language-system product. No specific version information is supplied, so all releases that include speechmac_text.php with the vulnerable exec() logic are potentially impacted. Administrators should review whether their deployment contains this source file and compare its code to the reference implementation.

Risk and Exploitability

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of <1% suggests a low observed exploitation likelihood. The flaw permits unauthenticated remote execution of arbitrary commands via a crafted GET request. Although it is not yet listed in the CISA KEV catalog, the combination of unlimited command execution and no authentication makes it a high‑priority concern.

Generated by OpenCVE AI on July 21, 2026 at 13:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official vendor patch or newer release that removes the insecure exec usage or properly sanitizes the id parameter, addressing the CWE‑78 input‑validation weakness.
  • If a patch is unavailable, enforce strict server‑side validation on the id parameter, allowing only numeric values or a predefined whitelist to block shell injection.
  • Restrict access to speechmac_text.php by requiring authentication or limiting inbound traffic to trusted management hosts via a firewall or VPN.

Generated by OpenCVE AI on July 21, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Guardian
Guardian language-system
Vendors & Products Guardian
Guardian language-system

Wed, 01 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Title Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Guardian Language-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-14T18:40:23.048Z

Reserved: 2026-03-25T18:43:09.827Z

Link: CVE-2026-34111

cve-icon Vulnrichment

Updated: 2026-07-01T18:07:04.187Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T14:00:05Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')