CVE-2026-34113: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech_text.php

Synopsis

This is an OS command injection vulnerability in Guardian language-system, a PHP-based application. The flaw exists in speech_text.php, where the id GET parameter is passed directly into a PHP exec() call without any sanitization or authentication check, allowing an unauthenticated attacker to reach it over the network by appending shell metacharacters to a simple HTTP request. Successful exploitation gives the attacker arbitrary OS command execution on the server, enabling full system compromise including data theft, file modification, and persistent access. HarborGuard is tracking the advisory for patch availability since no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the server running speech_text.php.

• AuthenticationNot required

  No credentials or session token of any kind are required; the vulnerable exec() call is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker sends a crafted HTTP GET request directly to the server; no user action or social engineering is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free; appending shell metacharacters to the id parameter requires no race conditions, memory layout knowledge, or environmental setup.

Blast Radius

• Attacker executes arbitrary OS commands as the web server process user, enabling full read access to all files on the host including credentials, private keys, and application data.
• Attacker can write or overwrite files on the server, modifying application code, configuration, or injecting backdoors for persistent access.
• Attacker can crash or kill running processes on the host, taking down the affected service and any co-located services.