CVE-2026-34101
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An SQL injection vulnerability in the Guardian language-system component allows an authenticated attacker to inject malicious SQL code via the 'id' parameter in text_file.php. Lack of input sanitization enables extraction of database contents.
Risk Assessment
An attacker can exfiltrate sensitive data stored in the database, including user data or system content, leading to confidentiality and integrity breaches.
Recommendation
Immediately update the Guardian language-system component to a version that fixes the 'id' parameter validation or use parameterized SQL queries (prepared statements).
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.