Which versions of Guardian language-system are affected by CVE-2026-34101?

Guardian language-system contains an easily exploitable SQL injection vulnerability enabling unauthenticated extraction of the entire database through a simple HTTP GET request.

Is there a public PoC exploit available for CVE-2026-34101?

Yes, a public proof-of-concept exploit is available for CVE-2026-34101. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-34101?

Within 24 hours, disable or restrict all external access to the affected text_file.php endpoint and review database access logs for indicators of exploitation. Within 7 days, implement input validation rules and Web Application Firewall (WAF) rules to block malformed id parameter requests, and apply principle-of-least-privilege database credentials to limit the application user's permissions. Within 30 days, contact the vendor to confirm patch status and timelines, internally review and patch the source code if available, and evaluate alternative solutions or application redesign to isolate risk until a vendor patch is released.

Guardian language-system CVE-2026-34101

Q: What is the CVSS score of CVE-2026-34101?

CVE-2026-34101 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41058 HIGH

SQL Injection (CWE-89)

2026-07-01 VulnCheck

GHSA-5387-2p2x-h6ff

PHP SQLi Guardian Language System

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible endpoint needing no complexity or interaction; PR:L consistent with CVSS 4.0 source vector and authenticated-attacker description; scope unchanged as impact is confined to the local database.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 24, 2026 - 11:51 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 24, 2026 - 11:49 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 24, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Aug 24, 2026 - 11:22 NVD

CRITICAL HIGH

CVSS changed

Aug 24, 2026 - 11:22 NVD

9.3 (CRITICAL) 8.7 (HIGH)

Analysis Generated

Jul 01, 2026 - 16:54 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

AnalysisAI

Error-based SQL injection in Guardian language-system's text_file.php exposes the full database to extraction via a trivially crafted HTTP GET request. The unsanitized id parameter is concatenated directly into a SQL query at line 17 - a textbook CWE-89 flaw in a PHP application - enabling iterative database enumeration and data exfiltration. A public exploit exists on GitHub, SSVC classifies it as automatable with total technical impact, and while EPSS is low at 0.37%, the automatable nature and public POC availability demand prompt remediation for any deployment. No vendor-released tagged patch has been confirmed at time of analysis.

Technical ContextAI

The vulnerable code in text_file.php at line 17 concatenates the raw GET parameter id directly into a SQL SELECT statement with no parameterization, casting, or escaping: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$_GET['id']."'. This is a canonical CWE-89 (Improper Neutralization of Special Elements used in an SQL Query) pattern common in legacy PHP codebases that predate widespread adoption of PDO prepared statements. The error-based injection technique referenced in the description implies the application reflects SQL error messages to the HTTP client, enabling data extraction without blind timing or Boolean-based approaches - reducing exploitation complexity further. The affected product is identified by CPE cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*, a PHP-based language and file management system developed under the Guardian project.

RemediationAI

No vendor-released patch with a confirmed tagged version has been identified at time of analysis; the EUVD affected-version boundary is defined by git commit hash e42c395ec4b03fe62973a669c9209a673838b8a4, indicating a code-level upstream fix may exist but a formally released patched version is not independently confirmed. The definitive remediation is to rewrite the SQL query in text_file.php at line 17 using PDO prepared statements with bound parameters, eliminating string concatenation entirely - this is the only fix that fully addresses the root cause. As a compensating control, restrict access to text_file.php at the web server layer using nginx location blocks or Apache FilesMatch directives, limiting access to authenticated sessions or trusted IP ranges; note this will break legitimate functionality if the endpoint serves anonymous users and the authentication conflict is resolved in favor of unauthenticated access. Deploying a WAF rule to enforce strict integer-only validation on the id parameter provides an additional defense-in-depth layer with low false-positive risk given the parameter's expected numeric type. Refer to the VulnCheck advisory at https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-sql-injection-via-id-parameter-in-text-file-php for further guidance.