Guardian language-system concatenates the id GET parameter directly into a SELECT statement without any sanitization. This flaw allows an attacker who can supply a crafted value for id to cause an error‑based SQL injection, revealing the contents of the files table, such as filename, extension, type, duration, owner and privacy flags. The weakness is identified as CWE‑89 and can lead to unauthorized disclosure of application data.

The vulnerability exists within the Guardian language-system component. All installations that include text_file.php are potentially affected, regardless of version, as the flaw is in the code logic itself. There is no version information disclosed, so any deployment of this application requires assessment for this issue.

The CVSS score of 9.3 signals a high‑severity condition. Exploitation requires an authenticated session to the application and a crafted GET request to text_file.php containing a malicious id payload. The EPSS score of less than 1% indicates low current exploitation probability, and the vulnerability is not catalogued in CISA KEV. The primary impact is confidential data leakage via the affected SELECT query.