CVE-2026-34113: Guardian Language-System RCE Vulnerability

CVE-2026-34113 Overview

CVE-2026-34113 is an unauthenticated OS command injection vulnerability in the Guardian language-system application. The flaw resides in speech_text.php at line 18, where the id GET parameter is concatenated directly into a PHP exec() call without sanitization. A remote attacker can append shell metacharacters to the id parameter to execute arbitrary operating system commands on the underlying server. No authentication or user interaction is required, and the vulnerability is exploitable over the network. The issue is tracked under CWE-78: OS Command Injection.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands with the privileges of the PHP process, leading to full server compromise.

Affected Products

Guardian language-system (speech_text.php)
Deployments exposing the speech_text.php endpoint over HTTP
Any instance calling jobs/speech_audio_text.php via the vulnerable exec() path

Discovery Timeline

2026-07-01 - CVE-2026-34113 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-34113

Vulnerability Analysis

The vulnerability exists in the speech_text.php script of the Guardian language-system. On line 18, the script constructs a shell command by concatenating the $_GET['id'] value directly into a PHP exec() invocation: exec("php jobs/speech_audio_text.php ".$login_session." ".$_GET['id']." ..."). Because the input is neither validated nor escaped, an attacker can inject shell metacharacters such as ;, |, &&, or backticks. These characters break out of the intended argument context and allow additional commands to be executed by the shell interpreter.

The endpoint requires no authentication, meaning any attacker able to reach the web application can invoke the vulnerable code path. Successful exploitation grants command execution under the account running the PHP interpreter, typically the web server user. From that foothold, attackers can pivot to credential theft, lateral movement, or persistence.

Root Cause

The root cause is unsafe use of exec() combined with unsanitized user input. PHP provides escapeshellarg() and escapeshellcmd() for command-argument sanitization, but neither is applied here. The id parameter is treated as trusted numeric input despite originating from the client.

Attack Vector

An attacker sends a crafted HTTP GET request to speech_text.php with an id parameter containing shell metacharacters followed by an arbitrary command. For example, a value such as 1;<command> causes the shell to execute the injected command after the intended php jobs/speech_audio_text.php invocation completes. Because the vector is network-based and pre-authentication, mass scanning and automated exploitation are feasible.

Detailed technical analysis is available in the VulnCheck Security Advisory and a proof-of-concept gist.

Detection Methods for CVE-2026-34113

Indicators of Compromise

HTTP GET requests to speech_text.php containing shell metacharacters (;, |, &, `, $() in the id parameter.
Unexpected child processes spawned by the PHP interpreter, such as sh, bash, curl, wget, nc, or python.
Outbound network connections originating from the web server host to unfamiliar external endpoints shortly after requests to speech_text.php.
New or modified files in web-accessible directories following requests to the vulnerable endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules that flag or block shell metacharacters and command keywords in the id query parameter of speech_text.php.
Correlate web access logs with process execution telemetry to identify PHP processes spawning shells or network utilities.
Alert on execution of jobs/speech_audio_text.php immediately followed by unrelated OS commands within the same process tree.

Monitoring Recommendations

Enable verbose logging on the web server and capture full query strings for the speech_text.php endpoint.
Monitor egress traffic from the web server for anomalous destinations that may indicate reverse shells or payload retrieval.
Baseline normal child-process behavior for the PHP interpreter and alert on deviations.

How to Mitigate CVE-2026-34113

Immediate Actions Required

Restrict network access to speech_text.php at the perimeter or reverse proxy until a fix is deployed.
Add a WAF signature to block requests where the id parameter contains non-numeric characters.
Review web server and application logs for prior exploitation attempts targeting the vulnerable endpoint.
Rotate credentials and secrets accessible to the web server account if compromise is suspected.

Patch Information

No vendor patch is referenced in the available advisory data. Consult the VulnCheck Security Advisory for the latest remediation guidance from the vendor.

Workarounds

Modify speech_text.php to validate that $_GET['id'] matches a strict allowlist, such as a numeric-only regular expression, before use.
Replace the direct concatenation in exec() with escapeshellarg($_GET['id']) to neutralize shell metacharacters.
Run the PHP interpreter under a low-privilege account and restrict its ability to spawn shell interpreters using operating system controls.
Disable the speech_text.php endpoint if the speech-to-text feature is not required.

bash

# Configuration example: minimal ModSecurity rule to block metacharacters in id parameter
SecRule ARGS:id "@rx [^0-9]" \
    "id:1003411,phase:2,deny,status:403,\
    msg:'CVE-2026-34113: non-numeric id parameter blocked',\
    tag:'attack-injection',logdata:'%{MATCHED_VAR}'"