What is the CVSS score of CVE-2026-28429?

CVE-2026-28429 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2026-28429?

CVE-2026-28429 is a critical remote file read vulnerability in Talishar (Flesh and Blood fan-made game) that allows unauthenticated attackers to access arbitrary server files through path traversal…

How to fix or mitigate CVE-2026-28429?

Within 24 hours: Identify all Talishar server instances and assess network exposure (check if ParseGamestate.php is accessible from untrusted networks). Within 7 days: Apply the vendor patch by updating to commit 6be3871 or later; if running from a release distribution, contact the Talishar project for patched version availability and test in non-production environment first. Within 30 days: Conduct forensic review of access logs for ParseGamestate.php requests with suspicious gameName parameters (path traversal indicators like '../', '..\', or encoded variants); rotate any credentials or sensitive data potentially exposed.

PHP CVE-2026-28429

HIGH

Path Traversal (CWE-22)

2026-03-06 security-advisories@github.com

PHP Path Traversal

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 20, 2026 - 13:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 20, 2026 - 13:22 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 05:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified in the gameName parameter. While the application's primary entry points implement input validation, the ParseGamestate.php component can be accessed directly as a standalone script. In this scenario, the absence of internal sanitization allows for directory traversal sequences (e.g., ../) to be processed, potentially leading to unauthorized file access. This issue has been patched in commit 6be3871.

AnalysisAI

Remote unauthenticated attackers can read arbitrary files from Talishar (Flesh and Blood fan-made game) servers via path traversal in the ParseGamestate.php script's gameName parameter. The vulnerability affects all versions prior to commit 6be3871 and allows direct access to sensitive server files without authentication (CVSS 7.5, AV:N/PR:N). While EPSS exploitation probability is relatively low (0.47%, 64th percentile), the unauthenticated remote attack vector and confirmed patch availability make this a priority for exposed deployments. No active exploitation or public POC identified at time of analysis.

Technical ContextAI

ParseGamestate.php in the Talishar game engine can be invoked directly as a standalone PHP script, bypassing the application's front-end input validation layer. The gameName parameter accepts directory traversal sequences (../) without sanitization, enabling CWE-22 Path Traversal attacks. This architectural weakness - where internal components lack defensive validation when accessed directly - is common in PHP applications that assume all requests will flow through a controlled entry point. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with no authentication barrier. The affected CPE (cpe:2.3:a:talishar:talishar) covers the open-source Flesh and Blood card game implementation, typically self-hosted by gaming communities on web servers running PHP.

RemediationAI

Update Talishar to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48 or later, which implements input sanitization in ParseGamestate.php. The patch commit is available at https://github.com/Talishar/Talishar/commit/6be3871a14c192d1fb8146cdbc76f29f27c1cf48. If immediate patching is not feasible, implement these compensating controls: restrict direct access to ParseGamestate.php by configuring web server rules (Apache .htaccess or nginx location blocks) to deny requests to this file unless they originate from the application's front-end controllers - this prevents the bypass of input validation while maintaining application functionality, though it requires careful testing to avoid breaking legitimate game state parsing. Alternatively, apply IP whitelisting to limit server access to trusted players only, reducing exposure to unknown attackers but requiring maintenance of access control lists. Review web server logs for requests to ParseGamestate.php containing ../ sequences to identify potential exploitation attempts. Full vendor advisory at https://github.com/Talishar/Talishar/security/advisories/GHSA-f386-xhcw-jrx8.