Guardian language‑system contains an unauthenticated vulnerability that allows an attacker to craft a malicious id parameter in the text_to_subtitles.php script. The value is concatenated directly into a PHP exec() call without any validation, enabling OS command injection. Because the call runs with the privileges of the web worker process, an attacker can execute arbitrary shell commands, potentially leading to full system compromise, data theft, or denial of service. The flaw is classified as CWE‑78.

Deployments of Guardian language‑system that include the vulnerable text_to_subtitles.php snippet are affected. The CVE entry does not list specific releases; system owners should inspect their code to confirm presence of the exec() call with an unsanitized id parameter.

The CVSS score of 9.3 marks the issue as critical, while the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can trigger the flaw by sending a crafted GET request such as /text_to_subtitles.php?id=123;rm -rf / and cause arbitrary command execution on the server.