Description
Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/transcribe_amazon.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Published: 2026-07-01
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Guardian Language‑System executes an OS command constructed from an unsanitized GET parameter, enabling an attacker to inject shell metacharacters and run arbitrary commands. This flaw is a classic OS command injection (CWE‑78) that grants full remote code execution, compromising the host’s confidentiality, integrity, and availability.

Affected Systems

All installations of Guardian Language‑System that expose the transcribe_amazon.php endpoint to external HTTP traffic are affected. The vulnerability exists in the source code at line 15, and no specific product version is listed. Any deployment containing that line is vulnerable, irrespective of maintenance status.

Risk and Exploitability

The CVSS base score of 9.3 classifies the issue as critical. The EPSS score of <1% suggests exploitation is not yet widespread, but the problem can be triggered with a simple GET request and requires no authentication, making the attack vector trivial for anyone with network access to the web server. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 1, 2026 at 23:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor patch or an updated version of Guardian Language‑System when one becomes available.
  • Restrict exposure of transcribe_amazon.php by enforcing authentication or applying firewall rules to limit access.
  • Modify the script to validate the id parameter or wrap it with PHP’s escapeshellarg() to sanitize the input before executing the command.
  • Monitor logs and system processes for signs of unauthorized command execution.

Generated by OpenCVE AI on August 1, 2026 at 23:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Guardian
Guardian language-system
Vendors & Products Guardian
Guardian language-system

Wed, 01 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/transcribe_amazon.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Title Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Guardian Language-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-14T18:40:25.800Z

Reserved: 2026-03-25T18:43:09.828Z

Link: CVE-2026-34115

cve-icon Vulnrichment

Updated: 2026-07-01T17:44:43.331Z

cve-icon NVD

Status : Deferred

Published: 2026-07-01T17:16:34.907

Modified: 2026-07-14T19:17:01.180

Link: CVE-2026-34115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T23:15:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')