Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/trans…

CVE-2026-34114 affects the Guardian language-system application, where the 'id' GET parameter in translate_text.php (line 18) is passed directly into a PHP exec() call without any sanitization. The vulnerable code concatenates user-supplied input into a shell command, allowing shell metacharacters to be appended. No authentication is required to exploit this vulnerability, making it accessible to any unauthenticated remote attacker. Successful exploitation allows arbitrary OS command execution on the server. The vulnerability is classified as an OS Command Injection flaw. It poses a critical risk due to the combination of unauthenticated access and remote code execution capability. The issue was disclosed via NVD, a GitHub Gist proof-of-concept, and a VulnCheck advisory.