CVE-2026-34097: Guardian Language-System XSS via id Parameter in text_file.php
Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php (lines 94, 101, 323, 403, 826, 852). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34097?
CVE-2026-34097 has a medium severity score of 4.6.
How does CVE-2026-34097 affect Guardian Language-System?
CVE-2026-34097 allows an authenticated attacker to exploit a cross-site scripting (XSS) vulnerability by manipulating the id parameter in text_file.php.
What are the consequences of exploiting CVE-2026-34097?
An attacker can inject malicious script tags that execute in the victim's browser session, potentially compromising user data.
How do I fix CVE-2026-34097?
To fix CVE-2026-34097, ensure that the id GET parameter is properly sanitized before use in HTML attributes in the affected text_file.php file.
Who is affected by CVE-2026-34097?
Users of the Guardian Language-System are affected by CVE-2026-34097 if they have an authenticated session and the vulnerable text_file.php file is present.