CVE-2026-34116: Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe.php

Synopsis

OS command injection in Guardian language-system allows an unauthenticated remote attacker to execute arbitrary operating system commands on the server. The vulnerable code in transcribe.php passes a user-supplied GET parameter directly into a PHP exec() call with no sanitization and no login check, meaning any HTTP request to the endpoint is sufficient to trigger it. Successful exploitation gives an attacker full code execution on the underlying host, enabling data theft, data modification, and service disruption. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available the moment one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the transcribe.php endpoint over the network; any host with HTTP access to the server qualifies.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable endpoint accepts unauthenticated requests.

• Victim interactionNot required

  Exploitation requires no action from a logged-in user or administrator; the attacker acts entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free: appending shell metacharacters to the id GET parameter is sufficient with no race conditions or environmental prerequisites.

Blast Radius

• Reads any file readable by the web server process, including application secrets, credentials, and stored user data.
• Writes or modifies files on the server, enabling webshell placement or tampering with application data.
• Executes arbitrary processes on the host, which can be used to pivot to internal network resources or install persistent backdoors.
• Crashes or disrupts the affected service by killing processes or exhausting system resources.