Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-34111: Guardian Language-System Allows Unauthenticated OS Command Execution
CVE-2026-34111
CVE-2026-34111
Summary
An attacker can run arbitrary system commands on the Guardian server without a password, potentially gaining access to sensitive data or disrupting the system. This is a serious risk because no authentication is required to exploit the vulnerability. The affected system should be updated to fix this issue as soon as possible.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| guardian | language-system | <= e42c395ec4b03fe62973a669c9209a673838b8a4 |
Original title
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php
Original description
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
nvd CVSS3.1
9.8
nvd CVSS4.0
9.3
Vulnerability type
CWE-78
OS Command Injection
Published: 1 Jul 2026 · Updated: 23 Jul 2026 · First seen: 1 Jul 2026