Read the docs
TI-2026-22703 Aliases CVE-2026-28429

Talishar: Critical Path Traversal in gameName Parameter

Priority HIGH 72CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified in the gameName parameter. While the application's primary entry points implement input validation, the ParseGamestate.php component can be accessed directly as a standalone script. In this scenario, the absence of internal sanitization allows for directory traversal sequences (e.g., ../) to be processed, potentially leading to unauthorized file access. This issue has been patched in commit 6be3871.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00817 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Talishar (Talishar): 6be3871a14c192d1fb8146cdbc76f29f27c1cf48

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TalisharTalisharbefore 6be3871a14c192d1fb8146cdbc76f29f27c1cf486be3871a14c192d1fb8146cdbc76f29f27c1cf48Patch availableCNA
  • Talishar VendorTalishar Affected before 6be3871a14c192d1fb8146cdbc76f29f27c1cf48 Fixed in 6be3871a14c192d1fb8146cdbc76f29f27c1cf48 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:talishar:talishar:*:*:*:*:*:*:*:*before 2026-02-22VulnerableTalishar
  • cpe:2.3:a:talishar:talishar:*:*:*:*:*:*:*:* Versions before 2026-02-22 Vulnerable ·Talishar

Remediation

  • Fix · CNA Talishar (Talishar) Fixed in 6be3871a14c192d1fb8146cdbc76f29f27c1cf48

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28429

References

Exploit 1

Patch 1

  • TI-2026-22702 Talishar: Authentication Bypass via Empty authKey Parameter Allows Unauthenticated Game Actions CVSS 3.1MEDIUM 5.3
  • TI-2026-22014 Talishar Vulnerable to Cross-Site Request Forgery (CSRF) CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences