CVE-2026-34112CWE-78

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php

Critical · published July 1, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
60.3
In the wild
Unconfirmed
What it is

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00930 · 60.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-01T16:20Z
EPSS history
Timeline
  • 01 JUL 16:20Z
    Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php
    cvelistv5