Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_r…

CVE-2026-34106 is a critical unauthenticated OS command injection vulnerability in the Guardian language-system application. The vulnerability exists in subtitles.php at line 19, where the id GET parameter is passed unsanitized directly into a PHP exec() call. No authentication is required to exploit this flaw, making it accessible to any remote unauthenticated attacker. An attacker can append shell metacharacters to the id parameter to execute arbitrary operating system commands on the server. The vulnerable code pattern is: exec('php jobs/subtitle_rendering.php '.$login_session.' '.$_GET['id'].'...'). This represents a severe risk as it allows full server compromise without any prior access or credentials. The vulnerability has been documented on NVD, with additional advisories published on VulnCheck and a proof-of-concept available on GitHub Gist.