Guardian's language‑system module executes the id query string directly within a PHP exec() call without any validation. This unchecked concatenation allows an attacker to embed shell metacharacters and run arbitrary OS commands on the host. The flaw enables unauthenticated remote code execution, compromising confidentiality, integrity, and availability of the affected system. The weakness is classified as CWE‑78, OS Command Injection.

All installations of the Guardian language‑system component that expose the vulnerable text.php endpoint are susceptible. Administrators should verify whether their deployment includes this module, whether the text.php file is reachable over the network, and whether the id parameter is exposed to clients.

The CVSS score of 9.3 indicates critical severity, while the EPSS score of <1% suggests a low current exploitation probability but does not diminish the potential impact. The vulnerability remains in the CISA KEV list as not listed, yet the absence of a KEV entry does not reduce its risk. No authentication is required; any client capable of crafting an HTTP GET request to text.php can exploit the flaw, making it trivially reachable over the network.