Guardian Language‑System has a PHP script, translate.php, that concatenates the id GET parameter directly into an exec() call without any sanitization. This unsanitized handling allows a remote attacker to inject shell metacharacters into the id value, causing the PHP process to execute arbitrary operating‑system commands. The flaw is a classic OS command injection (CWE‑78) and operates without requiring any authentication.

The vulnerability is confined to the Guardian Language‑System product, specifically its translate.php endpoint. No version information is available, so any installation that includes this script should be considered potentially affected.

The CVSS score of 9.3 categorizes the issue as Critical, while the EPSS estimate of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path is a simple unauthenticated HTTP GET request to translate.php with a crafted id parameter. Because no authentication is required, an attacker can trigger the flaw from anywhere, leading to arbitrary command execution on the host.