CVE-2026-34109: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php

Synopsis

OS command injection in the Guardian language-system web application allows an unauthenticated remote attacker to execute arbitrary operating system commands on the server by appending shell metacharacters to the id GET parameter in speech.php. The vulnerable code passes user-supplied input directly into a PHP exec() call with no sanitization or authentication check, reachable over the network with no credentials required. Successful exploitation gives the attacker full command execution on the host, enabling data theft, file modification, and service disruption. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the speech.php endpoint over the network; the vulnerability is exposed on any host where the web application is publicly or internally reachable.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the vulnerable endpoint accepts unauthenticated GET requests.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly and receives command output without any action from a logged-in user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; appending standard shell metacharacters to the id parameter is sufficient with no race conditions or environment-specific prerequisites.

Blast Radius

• The attacker executes arbitrary OS commands as the web server process user, gaining an interactive or scripted foothold on the host.
• All files readable by the web server process are exposed, including application source code, configuration files, and stored credentials or API keys.
• The attacker can write or overwrite files on disk, injecting backdoors, altering application logic, or corrupting stored data.
• The web server process and dependent services can be terminated or resource-exhausted, taking the application offline.