Executive brief
The Guardian language-system, a tool for automatic translation and subtitling, contains a security flaw in its designer component. An attacker can exploit this to gain unauthorized access to the underlying database, potentially exposing sensitive translation data or system configuration. This could lead to a complete compromise of the application's data integrity and confidentiality.
Technical details
A SQL injection vulnerability exists in the Guardian language-system due to improper sanitization of the 'name' GET parameter in 'designer.php' at line 124. The application concatenates the user-supplied input directly into a SQL query string: 'SELECT * FROM complex WHERE name=...'. While some documentation suggests authentication is required, the vulnerability is reported as having no preconditions (PR:N) in CVSS metrics, allowing a remote attacker to perform error-based SQL injection. This can be used to extract sensitive information from the database, including user credentials and system metadata. The issue affects versions up to and including git commit e42c395.
Affected products
- Guardian language-system <= commit e42c395ec4b03fe62973a669c9209a673838b8a4
Timeline
- 2026-07-01: disclosed: Vulnerability disclosed by researcher philopentest via VulnCheck and GitHub Gist.
- 2026-07-01: advisory: CVE-2026-34104 published.