CVE-2026-34107: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php

Synopsis

This is an OS command injection vulnerability in the Guardian language-system web application. An unauthenticated attacker reachable over the network can append shell metacharacters to the id GET parameter in translate.php, which is passed unsanitized into a PHP exec() call, causing the server to run arbitrary operating system commands. Successful exploitation gives the attacker full control over command execution on the host, enabling data theft, file modification, or complete server takeover. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send HTTP GET requests to the vulnerable translate.php endpoint over the network; any internet-exposed or internally reachable deployment is in scope.

• AuthenticationNot required

  No credentials or session tokens of any kind are needed; the vulnerable exec() call is reachable by any anonymous HTTP request.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action, click, or social engineering is involved.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: appending standard shell metacharacters to the id parameter is sufficient, with no race conditions or environment-specific prerequisites.

Blast Radius

• The attacker executes arbitrary OS commands as the web server process user, which can include reading any file readable by that account such as application secrets, credentials, and session data.
• The attacker can write or overwrite files on the server, enabling webshell placement, binary replacement, or corruption of stored application data.
• The attacker can crash or kill running processes, causing the affected service to become unavailable.
• With command execution established, the attacker can use the compromised host as a pivot point to probe other services on the same internal network segment.