Guardian language-system allows an attacker to inject operating system commands by supplying an unsanitized "id" GET parameter that is concatenated into a PHP exec() call. The lack of validation means that an unauthenticated user could append shell metacharacters and cause the web server to execute arbitrary commands, resulting in full compromise of confidentiality, integrity and availability of the host.

The vulnerability is present in the Guardian language-system application. Any deployment of the language-system component that includes subtitles.php is potentially affected; no specific product versions have been enumerated in the available data.

The CVSS score of 9.3 indicates critical severity. Based on the description, it is inferred that the attack vector is remote through the web interface, as no authentication is required and the vulnerable parameter is exposed in the URL. The EPSS score of less than 1% suggests that while exploitation is possible, the overall probability of active attacks is currently low. The flaw is not listed in the CISA KEV catalog.