CVE-2026-34107

48th percentile — higher than 48% of all known CVEs

The vulnerability in the Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

The risk for the organization includes full server compromise, data theft, malware installation, and use of the server for further attacks. The lack of required authentication increases the severity of the threat.

Immediately update the Guardian language-system to the latest version that fixes this vulnerability. Until the update, disable or secure the translate.php file and apply input filtering and validation to all user inputs.