Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_aud…

CVE-2026-34112 describes a critical OS command injection vulnerability in the Guardian language-system application. The vulnerability exists in speechmac.php at line 18, where the 'id' GET parameter is passed directly into a PHP exec() call without any sanitization. No authentication is required to exploit this flaw, making it accessible to any unauthenticated remote attacker. By appending shell metacharacters to the 'id' parameter, an attacker can execute arbitrary operating system commands on the server. The vulnerability is straightforward to exploit and carries significant risk due to the lack of authentication requirements. Proof-of-concept details are available via a public GitHub Gist and a VulnCheck advisory.