Which versions of Guardian Language-System are affected by CVE-2026-34100?

A critical vulnerability in Guardian language-system affects all deployed instances and allows authorized users with low-level access to extract complete database contents.

Is there a public PoC exploit available for CVE-2026-34100?

Yes, a public proof-of-concept exploit is available for CVE-2026-34100. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-34100?

Within 24 hours: restrict network access to the vulnerable media.php endpoint through firewall configuration, limiting access to essential personnel only, and enable detailed audit logging of all access attempts. Within 7 days: deploy Web Application Firewall rules to filter SQL injection patterns, establish continuous monitoring and alerting for suspicious database activities, and review access logs for evidence of prior unauthorized activity. Within 30 days: contact Guardian vendor to confirm patch availability timeline and obtain remediation guidance, conduct full database audit to detect unauthorized access, and develop permanent mitigation strategy including either sustained interim controls or evaluation of alternative products.

Guardian Language-System CVE-2026-34100

Q: What is the CVSS score of CVE-2026-34100?

CVE-2026-34100 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41057 HIGH

SQL Injection (CWE-89)

2026-07-01 VulnCheck

GHSA-cfq6-4647-8w5h

PHP SQLi Guardian Language System

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible endpoint, no complexity barrier, low-privilege auth required per description; full DB read/write/destroy capability justifies C:H/I:H/A:H within unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 24, 2026 - 11:53 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 24, 2026 - 11:51 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 24, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Aug 24, 2026 - 11:22 NVD

CRITICAL HIGH

CVSS changed

Aug 24, 2026 - 11:22 NVD

9.3 (CRITICAL) 8.7 (HIGH)

Analysis Generated

Jul 01, 2026 - 16:54 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

Articles & Coverage 1

News Critical SQL Injection in PHP Guardian Language System media.php - CVE-2026-34100 Jul 02, 2026

AnalysisAI

SQL injection in Guardian language-system's media.php endpoint allows low-privilege authenticated attackers to extract the full database via error-based injection through an unsanitized id GET parameter. All versions up to commit e42c395ec4b03fe62973a669c9209a673838b8a4 are affected, and a proof-of-concept is publicly available on GitHub. SSVC rates the attack as automatable with total technical impact, making this a high-priority remediation target despite a low EPSS score of 0.37% that likely reflects the product's limited deployment footprint rather than low exploitability.

Technical ContextAI

Guardian language-system is a PHP-based content management application. The root cause is CWE-89 (Improper Neutralization of Special Elements in an SQL Query), with the defect located at media.php line 17, where the raw $_GET['id'] value is concatenated directly into a SELECT statement: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$_GET['id']."'. No parameterization, prepared statements, or input escaping are applied. This classic string-concatenation pattern enables error-based SQL injection, a well-understood exploitation class allowing schema enumeration and data extraction through database error messages. The affected CPE is cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*, covering all versions with no lower bound.

RemediationAI

No tagged patched release version has been independently confirmed; the fix boundary is defined by a source commit hash rather than a packaged release, suggesting the upstream repository should be consulted for commits beyond e42c395ec4b03fe62973a669c9209a673838b8a4. The definitive code fix is to rewrite the query in media.php line 17 using parameterized statements - PDO with bindParam or MySQLi bind_param - which eliminates the injection surface with no operational side effects. As an interim compensating control, a web application firewall rule rejecting SQL metacharacters in the id parameter reduces exploitation risk, though WAF bypass via encoding or out-of-band techniques remains a residual risk. If the authentication discrepancy noted in the VulnCheck advisory is confirmed to mean the endpoint is publicly accessible without login, immediate network-layer restriction of media.php to authenticated sessions is warranted. Audit all other PHP files in the application for similar $_GET/$_POST concatenation patterns. References: https://nvd.nist.gov/vuln/detail/CVE-2026-34100 and https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad.