Guardian Language‑System accepts a user‑supplied id parameter via a HTTP GET request and concatenates it directly into an exec() call that runs a PHP script. This flaw is a classic example of CWE‑78: OS Command Injection. Because the value is not sanitized and no authentication barrier exists, an unauthenticated attacker can inject shell metacharacters to execute arbitrary operating‑system commands. The result is full remote command execution on the server, potentially allowing takeover of the underlying OS.

Any installation of Guardian Language‑System that includes the file complex not yet applied a patch to sanitize the id parameter can be affected. The advisory does not supply specific version numbers, so any system with this vulnerability present is at risk.

The CVSS score of 9.3 signals critical severity, while the EPSS score of 0.00549 suggests a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a crafted HTTP GET request to /complex_start.php with a malicious id; no prior authentication is needed. Successful exploitation would provide the user executing the server’s web process account with full command‑line access, potentially leading to complete system compromise.