Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/tr…

CVE-2026-34115 affects the Guardian language-system application, specifically the transcribe_amazon.php file. The vulnerability exists because the 'id' GET parameter is passed directly into a PHP exec() call at line 15 without any sanitization or validation. No authentication is required to exploit this flaw, making it accessible to any remote unauthenticated attacker. An attacker can append shell metacharacters to the 'id' parameter to execute arbitrary OS commands on the underlying server. This represents a critical OS command injection vulnerability with a wide potential impact. The vulnerable code pattern is: exec('php jobs/transcribe_amazon.php '.$login_session.' '.$_GET['id'].'...'). Exploitation could lead to full server compromise, data exfiltration, or further lateral movement. A proof-of-concept has been published on GitHub, increasing the risk of active exploitation.