Guardian language‑system allows an attacker to inject arbitrary shell commands through the id parameter of transcribe.php. The application concatenates the GET value directly into a PHP exec() call without any sanitization, a classic CWE‑78 flaw. Based on the description, it is inferred that this flaw enables remote command execution. Because no authentication is required, a malicious actor can send a crafted HTTP request and run any OS command on the server; based on the description, it is inferred that such arbitrary command execution could compromise confidentiality, integrity, and availability.

All installations of Guardian language‑system that contain the transcribe.php script are at risk. No specific vendor‑specified version information is provided; therefore any instance that has not applied a vendor patch or implemented safe coding practices should be treated as vulnerable.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score of less than 1 % shows that exploitation attempts are expected to be infrequent, yet possible. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the ability to execute arbitrary OS commands via an unauthenticated request could pose a significant security risk. Exploitation requires only a simple HTTP GET request to transcribe.php with injected shell metacharacters; no credentials or privileged access are needed.