Executive brief
The Guardian language-system, a tool used for automatic translation and subtitling, contains a critical security flaw. An unauthenticated attacker can remotely execute arbitrary commands on the server by sending a specially crafted web request. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of translation services.
Technical details
A command injection vulnerability exists in the Guardian language-system due to improper sanitization of the 'id' GET parameter in 'transcribe.php'. At line 15, the application passes this parameter directly into a PHP exec() call. Because no authentication is required to access this endpoint, a remote attacker can use shell metacharacters (e.g., semicolons or backticks) to execute arbitrary operating system commands with the privileges of the web server user. The vulnerability affects versions up to and including commit e42c395.
Affected products
- Guardian language-system <= commit e42c395ec4b03fe62973a669c9209a673838b8a4
Timeline
- 2026-07-01: disclosed: Initial disclosure by researcher philopentest via VulnCheck and GitHub Gist.
- 2026-07-01: advisory: CVE-2026-34116 published.