CVE-2026-34111: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php

Synopsis

An OS command injection vulnerability exists in Guardian language-system, a PHP-based language learning application. The affected component, speechmac_text.php, passes a user-supplied GET parameter directly into a PHP exec() call with no sanitization and no authentication required, meaning any remote attacker who can reach the web server can inject and execute arbitrary shell commands. Successful exploitation gives the attacker full command execution on the host operating system. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the web server to reach speechmac_text.php.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the vulnerable parameter is processed before any authentication check.

• Victim interactionNot required

  The attack is fully server-side; no user action, click, or social engineering is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply appends shell metacharacters to the id GET parameter with no race conditions or environmental dependencies to overcome.

Blast Radius

• Reads any file readable by the web server process, including application source code, configuration files, and stored credentials.
• Writes or overwrites files on the server filesystem, enabling webshell deployment or modification of application logic.
• Executes arbitrary OS commands, allowing lateral movement to other systems reachable from the host or installation of persistent backdoors.
• Crashes or disrupts the affected web service by terminating processes or consuming system resources.