CVE-2026-34104: Guardian Language-System Unauthenticated SQL Injection via name Parameter in designer.php

Synopsis

An unauthenticated SQL injection vulnerability exists in Guardian language-system, affecting all versions up to and including commit e42c395ec4b03fe62973a669c9209a673838b8a4. The flaw is reachable over the network with no credentials required, as the name GET parameter in designer.php is passed directly into a SQL query without sanitization. Successful exploitation gives an attacker read and write access to the underlying database, and can also disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable designer.php endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the host.

• AuthenticationNot required

  No credentials are needed; the CVSS vector specifies PR:N, meaning any anonymous HTTP request can trigger the injection. Note: the description mentions 'authenticated attacker' but the CVSS vector (PR:N) authoritatively indicates no authentication is required to exploit this vector.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends a crafted request directly to the endpoint.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental setup beyond network access to the service.

Blast Radius

• Reads all data stored in the database, including credentials, session tokens, and any application records.
• Modifies or deletes persisted database rows, allowing an attacker to tamper with application data or destroy records entirely.
• Crashes or degrades the database service, taking down dependent application functionality.