Talishar ParseGamestate.php gameName path traversal

Summaryinfo

A vulnerability labeled as critical has been found in Talishar. Affected is an unknown function of the file ParseGamestate.php. Executing a manipulation of the argument gameName can lead to path traversal. This vulnerability is tracked as CVE-2026-28429. The attack can be launched remotely. No exploit exists. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability classified as critical was found in Talishar (the affected version unknown). This vulnerability affects an unknown part of the file ParseGamestate.php. The manipulation of the argument gameName with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified in the gameName parameter. While the application's primary entry points implement input validation, the ParseGamestate.php component can be accessed directly as a standalone script. In this scenario, the absence of internal sanitization allows for directory traversal sequences (e.g., ../) to be processed, potentially leading to unauthorized file access. This issue has been patched in commit 6be3871.

The advisory is available at github.com. This vulnerability was named CVE-2026-28429 since 02/27/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

By approaching the search of inurl:ParseGamestate.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 6be3871a14c192d1fb8146cdbc76f29f27c1cf48 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-9982). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Talishar

License

• open-source

Website

• Product: https://github.com/Talishar/Talishar/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion