Guardian language‑system’s speech.php passes the id GET parameter directly into a PHP exec() call without sanitization. Unchecked input allows an unauthenticated remote attacker to inject shell metacharacters, resulting in arbitrary OS command execution. This flaw satisfies CWE‑78 and can compromise confidentiality, integrity, and availability of the affected system.

installations of Guardian Language‑System. No specific product versions are listed in the advisory, so the component is potentially impacted until a vendor correction is applied.

The CVSS score of 9.3 indicates critical severity. With an EPSS score of <1% the current likelihood of exploitation is considered low, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw is exploitable via unauthenticated HTTP requests to speech.php, requiring no credentials and only the ability to send a crafted id parameter. Attackers could thus execute arbitrary commands on the server, potentially compromising the entire environment.