CVE-2026-34112: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php

Synopsis

An OS command injection vulnerability affects Guardian language-system, a PHP-based language learning application. The flaw sits in speechmac.php, where the id GET parameter is passed unsanitized directly into a PHP exec() call; no authentication or special network position is required to reach it. A remote attacker can append shell metacharacters to that parameter and execute arbitrary operating system commands on the server, gaining full read, write, and disruption capability over affected hosts. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available the moment one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable speechmac.php endpoint is exposed over the network; an attacker must be able to send HTTP GET requests to the target server.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the vulnerable code path is fully unauthenticated.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout assumptions, or environmental prerequisites are required.

Blast Radius

• A successful attacker executes arbitrary OS commands as the web server process user, gaining an interactive shell or the ability to run any binary on the host.
• The attacker reads any file accessible to the web server process, including application source code, configuration files, and stored credentials or session tokens.
• The attacker writes or overwrites files on the server, enabling webshell deployment, binary replacement, or corruption of application data.
• The attacker can crash or resource-exhaust the affected service, taking the application offline for all users.