Guardian Language‑System exposes a translate_text.php endpoint that constructs a PHP exec() call by concatenating the id GET parameter without validation or sanitization. This creates a classic operating‑system command injection flaw (CWE‑78). Because no authentication is required, any unauthenticated attacker can append shell metacharacters to the id value and cause arbitrary commands to run on the server with the privileges of the web process, resulting in complete loss of confidentiality, integrity, and availability.

The flaw exists wherever the Guardian:Language‑System product includes translate_text.php. No explicit version range is specified, so any installation that exposes the file and does not restrict unauthenticated access is potentially impacted.

The CVSS score of 9.3 indicates critical severity and the lack of authentication allows exploitation from any reachable location. The EPSS score of less than 1 % shows low current exploitation probability in the wild, and the vulnerability is not listed in CISA KEV. An attacker can trigger the flaw by sending a crafted HTTP GET request containing, exploiting the server’s naive use of exec()