Executive brief
The Guardian language-system, a tool used for automatic translation and subtitling, contains a critical security flaw. An attacker can remotely execute commands on the server without needing a username or password. This could lead to a complete takeover of the system, theft of sensitive data, or disruption of translation services.
Technical details
The vulnerability is an OS command injection (CWE-78) located in the 'translate.php' component of the Guardian language-system. The application takes the 'id' GET parameter and passes it directly into a PHP exec() call without any sanitization or validation. Because this endpoint does not require authentication, a remote attacker can use shell metacharacters (e.g., semicolons or pipes) to execute arbitrary operating system commands with the privileges of the web server user. The issue affects versions up to and including commit e42c395. No official patch is currently noted, but sanitizing input or using escapeshellarg() is the recommended remediation.
Affected products
- Guardian language-system <= commit e42c395ec4b03fe62973a669c9209a673838b8a4
Timeline
- 2026-07-01: disclosed: Vulnerability details and PoC published by researcher philopentest
- 2026-07-01: advisory: NVD and VulnCheck published advisory details