Critical severity9.8NVD Advisory· Published Jul 1, 2026· Updated Jul 14, 2026
CVE-2026-34108
CVE-2026-34108
Description
Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.