Guardian Language‑System constructs an OS command by concatenating an unsanitized id GET parameter with other components and passes the result to PHP's exec() function. operating system, an attacker can inject shell metacharacters and execute arbitrary OS commands. The flaw is a classic CWE‑78 input‑to‑command injection that permits full remote code execution on the host, compromising confidentiality, integrity, and availability of the affected system.

All deployments of Guardian Language‑System that expose the transcribe_amazon.php script to external HTTP requests are vulnerable. No specific product versions are identified, so any installation containing the vulnerable line in the source code is affected regardless of whether the application is actively maintained.

The CVSS base score of 9.3 categorizes the issue as critical, while the EPSS score of <1% indicates that exploitation is not widespread yet. The vulnerability requires no authentication; a single crafted GET request to transcribe_amazon.php can trigger the exploit, rendering the attack vector trivial for anyone with network access to the web server. The flaw is not listed in the CISA KEV catalog.