Executive brief
The Guardian language-system, an automated translation and subtitling tool, contains a critical security flaw that allows unauthorized individuals to take control of the server. By sending a specially crafted web request to a specific component, an attacker can bypass security controls and run arbitrary commands. This could lead to a total compromise of the system, including the theft of sensitive data or the disruption of translation services.
Technical details
An OS command injection vulnerability exists in the Guardian language-system (an automated translation/subtitling tool) within the `complex_start.php` component. The application takes the `id` GET parameter and passes it directly into a PHP `exec()` call without any sanitization or validation. Because this endpoint does not require authentication, a remote, unauthenticated attacker can append shell metacharacters (such as semicolons or pipes) to the `id` parameter to execute arbitrary operating system commands with the privileges of the web server user. The vulnerability is present in versions up to and including commit e42c395.
Affected products
- Guardian language-system up to commit e42c395ec4b03fe62973a669c9209a673838b8a4
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory