CVE-2026-34108: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php

Synopsis

This is an unauthenticated OS command injection vulnerability in Guardian language-system, a PHP-based language management application. The flaw exists in text.php, where the id GET parameter is passed without sanitization directly into a PHP exec() call, allowing any remote attacker to append shell metacharacters and run arbitrary operating system commands. Successful exploitation gives an attacker full command execution on the server with no credentials required. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application over the network; the vulnerable text.php endpoint is exposed via standard HTTP and requires no special network position.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable exec() call is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker sends a crafted GET request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  The exploit is reliable and condition-free; appending shell metacharacters to the id parameter requires no timing, memory layout knowledge, or environmental preconditions.

Blast Radius

• Attacker executes arbitrary OS commands as the web server process user, enabling full control over the host environment.
• All data accessible to the server process, including stored credentials, session tokens, and application database contents, is readable by the attacker.
• Attacker can write, modify, or delete files on the server, including application code, configuration files, and persisted user data.
• Service availability is fully at the attacker's discretion; the attacker can terminate processes, exhaust resources, or destroy the filesystem.