CVE-2026-34115: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php

Synopsis

An OS command injection vulnerability affects Guardian language-system, a PHP-based transcription management application. The id GET parameter in transcribe_amazon.php is passed directly to a PHP exec() call with no sanitization and no authentication check, meaning any network-reachable attacker can send a crafted HTTP request to run arbitrary shell commands on the server. Successful exploitation gives an attacker full OS-level command execution, enabling data theft, file modification, or complete server takeover. HarborGuard tracks this advisory for patch availability and will make a patched rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the server running Guardian language-system.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable transcribe_amazon.php script accepts unauthenticated GET requests.

• Victim interactionNot required

  Exploitation requires no action from any user or administrator on the target system.

• Attack complexityDetail

  The exploit is straightforward and condition-free; appending shell metacharacters to the id parameter is sufficient to inject commands with no race conditions or special environmental prerequisites.

Blast Radius

• An attacker executes arbitrary OS commands under the web server process user, gaining an interactive shell or the ability to run any binary on the host.
• All data accessible to the server process, including database credentials, stored session tokens, and user records managed by Guardian language-system, can be read and exfiltrated.
• An attacker can write, overwrite, or delete files within the web root and any path the process user can access, corrupting application data or planting backdoors.
• The web server process can be killed or the host rebooted, taking the transcription service offline.