CVE-2026-34106: Guardian Language-System RCE Vulnerability

CVE-2026-34106 Overview

CVE-2026-34106 is an unauthenticated OS command injection vulnerability in the Guardian language-system application. The flaw resides in subtitles.php at line 19, where the id GET parameter is concatenated directly into a PHP exec() call without sanitization. Attackers can append shell metacharacters to the id parameter and execute arbitrary operating system commands on the underlying server. No authentication or user interaction is required to exploit the vulnerability. The issue is tracked under [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
An unauthenticated remote attacker can achieve arbitrary OS command execution on the host running Guardian language-system, leading to full server compromise.

Affected Products

Guardian language-system (subtitles.php component)

Discovery Timeline

2026-07-01 - CVE-2026-34106 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-34106

Vulnerability Analysis

The vulnerability exists in the subtitle rendering workflow of Guardian language-system. The subtitles.php script builds a shell command by concatenating user-controlled input from the id query parameter into a PHP exec() call. The resulting command follows the pattern php jobs/subtitle_rendering.php <login_session> <id> .... Because the id value is not validated, sanitized, or escaped, any shell metacharacters supplied by the attacker become part of the executed command line.

Since the endpoint requires no authentication, attackers can reach it directly over the network. Successful exploitation yields command execution under the privileges of the PHP process, typically the web server user. This provides a straightforward path to web shell deployment, credential theft, lateral movement, and persistence.

Root Cause

The root cause is unsafe use of exec() with unsanitized HTTP input. The code path incorporates $_GET['id'] into a shell command string without applying escapeshellarg(), escapeshellcmd(), or any allowlist validation. Because exec() invokes /bin/sh -c, shell metacharacters such as ;, |, &&, backticks, and $() are interpreted by the shell rather than treated as literal text.

Attack Vector

Exploitation requires a single HTTP GET request to the subtitles.php endpoint with a crafted id parameter containing shell metacharacters. For example, appending ;<command> or $(<command>) to the parameter value causes the injected command to run alongside the intended subtitle rendering job. The attack is remote, network-reachable, and requires no privileges or user interaction. Public exploitation details are documented in the VulnCheck Security Advisory and a GitHub Gist Exploit Code reference.

Detection Methods for CVE-2026-34106

Indicators of Compromise

HTTP GET requests to subtitles.php where the id parameter contains shell metacharacters such as ;, |, &, backticks, $(, or URL-encoded equivalents (%3B, %7C, %60).
Unexpected child processes spawned by the PHP or web server user, particularly shells (sh, bash) executing network utilities like curl, wget, or nc.
New or modified files under the web root that match web shell signatures following requests to subtitles.php.

Detection Strategies

Inspect web server access logs for requests to /subtitles.php and parse the id parameter for non-numeric characters or shell metacharacters.
Correlate web request timestamps with process creation events on the host to identify command execution originating from the PHP handler.
Deploy web application firewall rules that block or alert on shell metacharacters in query parameters targeting the subtitles.php endpoint.

Monitoring Recommendations

Alert on any process tree where the web server or PHP-FPM parent spawns interactive shells, package managers, or reverse-shell tooling.
Monitor outbound network connections from the Guardian language-system server to unfamiliar hosts, especially on ports commonly used by reverse shells.
Track file integrity in web-accessible directories to catch web shells dropped after successful command injection.

How to Mitigate CVE-2026-34106

Immediate Actions Required

Restrict network access to the Guardian language-system application until a patched version is available, permitting only trusted management networks.
Deploy WAF rules that reject requests to subtitles.php whose id parameter contains characters outside a strict numeric allowlist.
Review web and system logs for prior exploitation attempts and validate integrity of the web root and job scripts.

Patch Information

No vendor patch information is currently referenced in the advisory. Refer to the VulnCheck Security Advisory for updates. When a fix is released, the code should validate that id is strictly numeric and pass it through escapeshellarg() before use in exec().

Workarounds

Modify subtitles.php to cast $_GET['id'] to an integer (for example (int)$_GET['id']) before including it in the shell command.
Replace the exec() invocation with a parameterized job dispatch mechanism that does not invoke a shell interpreter.
Run the PHP worker under a least-privileged system account with no write access to the web root or job directories.

bash

# Configuration example: minimal ModSecurity rule to block metacharacters in the id parameter
SecRule REQUEST_URI "@contains /subtitles.php" \
    "chain,phase:2,deny,status:403,id:1026034106,\
    msg:'CVE-2026-34106 Guardian subtitles.php command injection attempt'"
    SecRule ARGS:id "@rx [^0-9]" "t:urlDecodeUni"