Executive brief
The Guardian language-system, an automated tool for translation and subtitling, contains a security flaw that allows unauthorized access to its internal database. By sending a specially crafted web request, an attacker can bypass security controls to view, modify, or delete sensitive information stored in the system. This could lead to a total compromise of the translation platform and the exposure of private media or configuration data.
Technical details
A SQL injection vulnerability exists in the Guardian language-system due to improper sanitization of the 'id' GET parameter in the 'translate_text.php' component. Specifically, at line 15, the application concatenates user input directly into a SQL query: SELECT id, filename, extension, type FROM files where id = '...'. Although some documentation suggests authentication is required, the CVSS metrics and proof-of-concept indicate this can be exploited over the network without valid credentials. An attacker can use error-based SQL injection techniques (such as GTID_SUBSET) to extract sensitive data from the database. The vulnerability affects versions up to and including git commit e42c395.
Affected products
- Guardian language-system up to commit e42c395ec4b03fe62973a669c9209a673838b8a4
Timeline
- 2026-07-01: disclosed: Initial researcher disclosure via GitHub Gist and VulnCheck advisory.
- 2026-07-01: advisory: CVE-2026-34105 published.