CVE-2026-34114: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate_text.php

Synopsis

An unauthenticated OS command injection vulnerability exists in Guardian language-system, a PHP-based translation application. The flaw is reachable over the network with no credentials required: the id GET parameter in translate_text.php is passed directly into a PHP exec() call without any sanitization, letting an attacker append shell metacharacters and run arbitrary operating system commands. Successful exploitation gives an attacker full command execution on the server, enabling data theft, file modification, or complete host takeover. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over HTTP/HTTPS, so an attacker must be able to reach the web server across the network to send the malicious request.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the vulnerable translate_text.php endpoint is fully public.

• Victim interactionNot required

  The attacker sends a single crafted GET request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free - appending shell metacharacters to the id parameter is sufficient without requiring timing, memory-layout knowledge, or any environmental pre-condition.

Blast Radius

• Reads any file readable by the web server process, including application credentials, database passwords, and stored session tokens.
• Writes or overwrites files on the server, including webshells or modified application code.
• Executes arbitrary system commands, enabling lateral movement to other services or hosts reachable from the server.
• Crashes or terminates running processes, causing service disruption for the hosted translation application.