CVE-2026-34110CWE-78

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php

Critical · published July 1, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/complex.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00930 · 60.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-01T16:19Z
EPSS history
Timeline
  • 01 JUL 16:19Z
    Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php
    cvelistv5