The vulnerability is a path traversal flaw in the ParseGamestate.php component of the Talishar project. Because that component can be invoked directly, the absence of internal sanitization allows a user to supply directory traversal sequences such as '../' in the gameName parameter. In this scenario the web server passes the unverified path to the file system, potentially exposing confidential files to an unauthenticated visitor. The flaw does not grant code execution, but it can lead to the disclosure of sensitive content stored on the server.

Talishar's fan‑made Flesh and Blood project is affected. The vulnerability applies to all builds that include the ParseGamestate.php script before commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48. No specific version string is supplied.

The CVSS score of 7.5 classifies the issue as high severity, while an EPSS score of less than 1% indicates that active exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to ParseGamestate.php with a crafted gameName parameter containing traversal sequences. No special privileges or authentication appear to be required, so a publicly connected attacker could trigger the fault and read arbitrary files readable by the web server process. The impact is primarily confidentiality loss.