External risk intelligence

Guardian Language System OS Command Injection via translate_text.php

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-34114

The vulnerability exists in a web application script (translate_text.php) and is reachable via a GET parameter. As a web-based translation service component, this functionality is commonly exposed as part of a public-facing web application or API, allowing unauthenticated remote access to the vulnerable endpoint.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Guardian language-system that could allow an unauthenticated attacker to execute arbitrary operating system commands on the server. This occurs because the `translate_text.php` script improperly handles a GET parameter, directly passing it to a PHP `exec()` function without proper validation. The main concern is confirming relevance and exposure of this component within our environment.

Unauthenticated attackers can run any OS command.
Critical vulnerability impacts server-side execution.
Confirm if this language system is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the `translate_text.php` script. This script directly uses the `id` parameter in a PHP `exec()` call without proper sanitization. By including shell metacharacters within the `id` parameter, an attacker can trick the `exec()` function into running arbitrary operating system commands on the server.

No authentication or special access needed.
Malicious input in `id` parameter.
Arbitrary command execution on server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the server. When supported by the advisory, this could lead to the compromise of system data, including sensitive configuration files and potentially impact the availability of the service.

Server-side commands could be executed.
Arbitrary OS commands could be run.
System data could be exposed or modified.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Guardian language-system allows unauthenticated remote attackers to execute arbitrary OS commands by manipulating the `id` GET parameter in `translate_text.php`. The first step is to identify all instances of the affected system, confirm their exposure and business criticality, and then determine the accountable owner for remediation planning.

Identify affected systems and owners.
Verify external reachability and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Guardian language-system?

The Guardian language-system is a software component designed to handle text translation tasks. It typically operates as a server-side utility that developers integrate into web applications or APIs to provide automated language processing features. It functions by taking input, such as identifiers for translation jobs, and processing them on the backend host.

What is the vulnerability class for CVE-2026-34114?

CVE-2026-34114 is classified as an OS Command Injection vulnerability, specifically identified as CWE-78. This means the software fails to properly sanitize user-supplied input before passing it to a system-level command execution function. As a result, the application inadvertently allows external input to be interpreted as part of the operating system commands it runs, rather than just as data.

How can an attacker trigger this command injection?

An attacker triggers this by sending a web request to the translate_text.php script with a maliciously crafted 'id' parameter. By including shell metacharacters in this parameter, they can break out of the intended command structure to execute their own instructions. Simply visiting the page without providing these specific, manipulated shell-sensitive characters will not trigger the command injection.

How does Halo Surface Signal categorize this threat?

Halo Surface Signal identifies this as a 'Likely' risk for systems running this technology. Because the vulnerability resides in a web-based translation script reachable via a standard GET request, it is often exposed to the internet. If your instance of this language system is accessible via a public-facing web application or API, it increases the likelihood that it could be targeted by remote, unauthenticated actors.

What should I do if I use the Guardian language-system?

Begin by auditing your infrastructure to locate all instances of the Guardian language-system currently in use. Once identified, determine which of these are reachable from outside your internal network and establish who is responsible for managing them. Prioritize these systems for review and work with the system owners to develop a plan to address the insecure handling of the 'id' parameter.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.