Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcrib…

CVE-2026-34116 is an unauthenticated OS command injection vulnerability in the Guardian language-system web application. The vulnerability exists in transcribe.php at line 15, where the id GET parameter is passed directly into a PHP exec() call without any sanitization or validation. Since no authentication is required to reach the vulnerable endpoint, any unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server. The flaw is straightforward to exploit and poses critical risk as it allows full remote code execution with the privileges of the web server process. There is no known authentication bypass required, making this trivially exploitable by any attacker with network access to the affected server.