A path traversal vulnerability in the Talishar project exposes the system to unauthorized file access by unauthenticated remote attackers.

The application fails to properly sanitize input in the gameName parameter within the ParseGamestate.php script. This flaw allows an unauthenticated attacker to supply directory traversal sequences to access restricted files on the host system.

The ability for an unauthenticated user to read arbitrary files from the server poses a significant risk to data confidentiality. This vulnerability, carrying a CVSS score of 7.5, could result in the exposure of sensitive configuration files, environment variables, or source code, potentially facilitating further system compromise or data theft.

Immediate Action: Update the Talishar installation to the latest version, ensuring the fix provided in commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48 is applied.

Proactive Monitoring: Review server access logs for requests containing directory traversal patterns such as "../" directed at the ParseGamestate.php component.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and restrict direct access to standalone PHP scripts that are not intended for public exposure.

Public Exploit Available: Unknown.

Given the high CVSS score and the existence of a proof-of-concept, administrators should treat this vulnerability with high priority. We strongly recommend applying the security patch immediately to eliminate the path traversal vector and prevent potential unauthorized information disclosure.