CVE-2026-28429 Talishar: Critical Path Traversal in gameName Parameter
Attackers can access unauthorized files via directory traversal in the gameName parameter of a standalone script in the Talishar web application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28429?
CVE-2026-28429 is a high-severity path traversal vulnerability in Talishar, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified in the gameName parameter. While the application's primary entry points implement input validation, the ParseGamestate.php component can be accessed directly as a standalone script. In this scenario, the absence of internal sanitization allows for directory traversal sequences (e.g., ../) to be processed, potentially leading to unauthorized file access. This issue has been patched in commit 6be3871.
Weakness: CWE-22
Which versions are affected by CVE-2026-28429?
It affects 1 product.
Products include Talishar Talishar.
How do I fix CVE-2026-28429?
No fix has been published for CVE-2026-28429 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-28429 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28429 exists.
Other vulnerabilities in Talishar
Sources
Also known as GHSA-f386-xhcw-jrx8.