Guardian language-system allows an authenticated user to inject arbitrary SQL into a query that retrieves file meta data. By supplying a crafted id value, the attacker can trigger errors that reveal database structure and contents, potentially exposing sensitive information stored in the files table. This weakness is a classic data‑exfiltration vulnerability classified as CWE‑89 and can compromise confidentiality and integrity of the database.

The vulnerability exists in the Guardian language-system application, specifically the text_file.php component. No version information is disclosed. Any installation that uses this component is potentially affected.

The CVSS score of 9.3 reflects a high‑severity defect with a likely exploitation scope of the entire database. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the KEV status shows the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack vector likely requires authentication to the application, but the absence of an access control test suggests the endpoint may be reachable by unauthenticated users as well. An attacker who can submit the id parameter can exploit the unsanitized input and obtain database contents through error messages.