Executive brief
The Guardian language-system, a tool used for automatic translation and subtitling, contains a critical security flaw. An attacker can remotely execute commands on the server without needing a username or password. This could lead to a complete takeover of the system, theft of sensitive data, or disruption of translation services.
Technical details
A command injection vulnerability exists in the Guardian language-system due to improper neutralization of special elements in the 'id' GET parameter. In 'text.php' at line 15, the application passes the unsanitized 'id' parameter directly into a PHP 'exec()' call. Because no authentication is required to access this endpoint, a remote attacker can append shell metacharacters (e.g., semicolons or backticks) to the 'id' parameter to execute arbitrary operating system commands with the privileges of the web server user. The vulnerability affects all versions up to commit e42c395.
Affected products
- Guardian language-system up to and including commit e42c395ec4b03fe62973a669c9209a673838b8a4
Timeline
- 2026-07-01: disclosed: Initial researcher disclosure and PoC published.
- 2026-07-01: advisory: CVE-2026-34108 published.