Which versions of Guardian Language-System are affected by CVE-2026-34105?

Guardian Language-System contains a SQL injection vulnerability (CVE-2026-34105, CVSS 8.7) for which publicly available exploit code exists.

Is there a public PoC exploit available for CVE-2026-34105?

Yes, a public proof-of-concept exploit is available for CVE-2026-34105. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-34105?

Within 24 hours: Immediately restrict network access to Guardian Language-System or remove from production; audit application and database logs for translate_text.php endpoint access to detect any prior exploitation attempts. Within 7 days: Deploy Web Application Firewall rules to block SQL injection patterns targeting the id parameter in translate_text.php; reduce database privileges for the Guardian service account to read-only access on essential tables only; review database audit logs for evidence of data extraction. Within 30 days: Contact Guardian vendor for security patch timeline and commitment; if no patch is committed within 90 days, evaluate and plan migration to alternative language processing systems; implement mandatory secure code review for all user-input handling across Guardian and similar third-party applications.

Guardian Language-System CVE-2026-34105

Q: What is the CVSS score of CVE-2026-34105?

CVE-2026-34105 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41062 HIGH

SQL Injection (CWE-89)

2026-07-01 VulnCheck

GHSA-w8fc-2h5h-r3hf

PHP SQLi Guardian Language System

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable endpoint with no complexity or interaction; PR:L reflects authenticated requirement per description and CVSS 4.0 PR:L; full CIA impact on database.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 24, 2026 - 11:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 24, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Aug 24, 2026 - 11:22 NVD

CRITICAL HIGH

CVSS changed

Aug 24, 2026 - 11:22 NVD

9.3 (CRITICAL) 8.7 (HIGH)

Analysis Generated

Jul 01, 2026 - 16:52 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

AnalysisAI

Error-based SQL injection in Guardian Language-System allows a network-accessible authenticated attacker to extract the full contents of the underlying database by passing unsanitized input through the id GET parameter in translate_text.php. The CVSS 4.0 score of 8.7 with a PR:L vector confirms authentication is required, though the VulnCheck advisory title labels this as 'unauthenticated' - a direct conflict with the CVE description that must be resolved before triaging. A publicly available proof-of-concept exploit exists on GitHub, and SSVC rates the attack as automatable with total technical impact, elevating operational urgency despite a low EPSS score of 0.37%.

Technical ContextAI

Guardian Language-System is a PHP-based application for managing language/translation assets. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and occurs at line 15 of translate_text.php, where the developer directly concatenates the raw $_GET['id'] value into a SQL SELECT query: SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."'. This classic string-interpolation anti-pattern enables error-based SQL injection, where the attacker manipulates the query structure to force database error messages that leak schema and row data. The affected CPE is cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*, covering all tracked versions up to and including the git commit e42c395ec4b03fe62973a669c9209a673838b8a4, indicating no formal versioned release has been patched.

RemediationAI

No vendor-released patched version has been independently confirmed; the fix boundary is defined only by git commit e42c395ec4b03fe62973a669c9209a673838b8a4, meaning operators should apply the upstream commit or any subsequent release that incorporates it. The definitive fix is to replace the string-concatenation query in translate_text.php line 15 with a parameterized prepared statement (e.g., PDO or MySQLi with bound parameters), which eliminates the injection surface entirely. As an immediate compensating control, restrict access to translate_text.php via web server rules (e.g., Apache Require ip or nginx allow/deny) to trusted IP ranges only - this limits exposure but does not fix the underlying flaw and will break legitimate remote usage. A Web Application Firewall rule blocking SQL metacharacters in the id parameter can serve as a secondary layer but is bypassable by advanced evasion. Consult the exploit POC at https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad to validate remediation effectiveness.