CVE-2026-34117: Guardian Language-System RCE Vulnerability

CVE-2026-34117 Overview

CVE-2026-34117 is an unauthenticated OS command injection vulnerability in the Guardian language-system application. The flaw exists in text_to_subtitles.php at line 19, where the id GET parameter is concatenated directly into a PHP exec() call without sanitization. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary operating system commands on the underlying server. The vulnerability is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands on the server, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Guardian language-system (text_to_subtitles.php)

Discovery Timeline

2026-07-01 - CVE-2026-34117 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-34117

Vulnerability Analysis

The vulnerability resides in the Guardian language-system script text_to_subtitles.php. At line 19, the application constructs a shell command by concatenating the user-supplied id GET parameter into a PHP exec() call of the form exec("php jobs/text_to_subtitles.php ".$login_session." ".$_GET['id']." ..."). Neither authentication nor input validation is performed before this concatenation. Because PHP's exec() invokes a shell, characters such as ;, &&, |, and backticks are interpreted as command separators or subshells. An attacker who supplies a crafted id value can therefore break out of the intended argument context and execute arbitrary commands under the privileges of the web server user.

Root Cause

The root cause is direct interpolation of untrusted HTTP input into an OS command string, without escaping via functions such as escapeshellarg() or escapeshellcmd(). Combined with the absence of an authentication check on the endpoint, any network-reachable client can trigger the vulnerable code path.

Attack Vector

Exploitation requires only an HTTP GET request to the vulnerable endpoint with a crafted id parameter. No credentials, user interaction, or prior access are needed. A proof-of-concept and advisory are published by third parties. See the VulnCheck Security Advisory and the GitHub Gist PoC for technical details.

Detection Methods for CVE-2026-34117

Indicators of Compromise

HTTP GET requests to text_to_subtitles.php where the id parameter contains shell metacharacters such as ;, |, &, $(, or backticks.
Web server processes spawning unexpected child processes such as sh, bash, wget, curl, nc, or python originating from the PHP interpreter.
Outbound network connections from the web server to unfamiliar hosts shortly after requests to the vulnerable endpoint.

Detection Strategies

Inspect web server access logs for requests to text_to_subtitles.php containing URL-encoded shell metacharacters in the id query string.
Correlate PHP exec() invocations with process creation events on the host to identify shell command execution derived from web input.
Deploy Web Application Firewall (WAF) rules that block metacharacters in the id parameter when targeting the affected script.

Monitoring Recommendations

Enable process-creation auditing on the web server and alert on child processes of the PHP or web server process that match shell binaries or common post-exploitation tools.
Monitor for new cron jobs, SSH keys, or persistence artifacts written by the web server user account.
Baseline outbound traffic from the web tier and alert on connections to newly observed external destinations.

How to Mitigate CVE-2026-34117

Immediate Actions Required

Restrict network access to the Guardian language-system application to trusted management networks until a fix is applied.
Disable or remove the text_to_subtitles.php endpoint if it is not required in production.
Review web server and application logs for prior exploitation attempts against the id parameter.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Consult the VulnCheck Security Advisory for the latest vendor guidance and remediation status.

Workarounds

Enforce strict server-side validation of the id parameter, allowing only expected characters such as numeric or alphanumeric identifiers.
Refactor the affected code to pass arguments safely, for example by wrapping user input with escapeshellarg() before concatenation into the command string.
Add authentication and authorization checks on the endpoint so that unauthenticated requests are rejected before reaching the vulnerable code path.
Deploy WAF signatures that block shell metacharacters in query parameters targeting text_to_subtitles.php.

bash

# Example WAF rule concept: block shell metacharacters in the id parameter
# ModSecurity-style pseudo-rule
SecRule ARGS:id "@rx [;&|`$()<>\\\\]" \
    "id:1026034117,phase:2,deny,status:403,\
    msg:'Potential CVE-2026-34117 command injection attempt',\
    tag:'CWE-78'"