CVE-2026-34110: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php

Synopsis

This is an OS command injection vulnerability in Guardian language-system, specifically in the complex_start.php script. The id GET parameter is passed directly into a PHP exec() call without any sanitization or authentication check, meaning an attacker can reach it over the network with no credentials at all. Successful exploitation gives the attacker arbitrary OS command execution on the server, with full read, write, and availability impact on the host. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the server running guardian language-system.

• AuthenticationNot required

  No authentication or session token is needed; the vulnerable complex_start.php script accepts requests from any unauthenticated caller.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free; appending shell metacharacters to the id GET parameter is sufficient to inject and execute arbitrary commands.

Blast Radius

• Attacker executes arbitrary OS commands on the server under the web process user, gaining an interactive foothold on the host.
• All data readable by the web server process is exposed, including application source code, configuration files, and any stored credentials or secrets.
• Attacker can write or overwrite files on the filesystem, enabling persistent backdoor installation or corruption of application data.
• The host process can be terminated or the service disrupted, taking the affected application offline.