Guardian language-system CVE-2026-34101

The vulnerability is triggered by supplying a malicious value to the id GET parameter in any HTTP request reaching text_file.php; no special application feature flag or non-default configuration is required beyond the endpoint being network-accessible. Authentication prerequisites are materially conflicted in the available data: the CVE description states the attacker must be authenticated and the CVSS 4.0 base vector specifies PR:L (low privilege required), implying a valid account is needed; however, the VulnCheck advisory URL explicitly labels this as 'unauthenticated SQL injection.' This conflict is unresolved and must be confirmed with the vendor or by direct testing before making access-control decisions. Attack complexity is low (AC:L) with no special attack requirements (AT:N), meaning no race condition, specific target state, or timing dependency applies. No user interaction is required. The limiting factor under the authenticated interpretation is possession of any valid application account.

The CVSS 4.0 score of 8.7 reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact on the vulnerable system and no subsequent-system scope change (SC:N/SI:N/SA:N). SSVC reinforces this: exploitation is poc-confirmed, the attack is automatable, and technical impact is classified as total. Despite these signals, EPSS is only 0.37% at the 29th percentile, suggesting limited observed in-the-wild exploitation activity at time of analysis - consistent with a niche product. No CISA KEV listing is present. A material conflict exists in the authentication data: the CVE description states 'authenticated attacker' and the CVSS 4.0 base vector specifies PR:L (low privileges required), yet the VulnCheck advisory URL explicitly describes this as 'unauthenticated SQL injection.' If the unauthenticated claim is accurate, real-world risk escalates substantially and the CVSS vector would understate exposure. Defenders should treat the unauthenticated scenario as the planning assumption until the vendor resolves this discrepancy.

A public exploit is available as a GitHub gist at https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad. An attacker sends a GET request to text_file.php with a payload such as id=' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT @@version)))-- -, causing the database engine to return version or schema data embedded in the HTTP error response. By iterating this technique against schema and table metadata, the attacker can systematically exfiltrate all database contents - including private file records, user credentials, and ownership data - with no need for timing analysis due to the error-based reflection.