CVE-2026-34106: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php

Synopsis

An unauthenticated OS command injection vulnerability affects Guardian language-system (all versions through commit e42c395ec4b03fe62973a669c9209a673838b8a4). The flaw is reachable over the network with no credentials required: the subtitles.php script passes a user-supplied GET parameter directly into a PHP exec() call without any sanitization. A remote attacker can append shell metacharacters to the id parameter and execute arbitrary operating system commands on the server. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable subtitles.php endpoint is exposed over the network; an attacker must be able to send HTTP requests to the server to reach it.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the vulnerable code path is entirely unauthenticated.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Exploitation is reliable and condition-free; appending shell metacharacters to the id GET parameter is sufficient to inject commands with no timing dependencies or environmental prerequisites.

Blast Radius

• A successful attacker executes arbitrary OS commands as the web server process user, gaining an interactive foothold on the host.
• The attacker reads any file accessible to the web server process, including application source code, configuration files, and stored credentials.
• The attacker writes or overwrites files on the server, enabling webshell placement or modification of application data.
• The attacker can crash or abuse server processes, disrupting availability of the Guardian language-system service and any co-located workloads.