Path traversal in simplesamlphp-module-casserver
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query parameters into this store. In deployments using FileSystemTicketStore, a remote attacker can use path traversal sequences such as ../target.serialized to make the CAS server read and unserialize files outside the ticket directory. In the CAS 1.0 validation flow, the same attacker-selected path is also passed to deleteTicket() immediately after getTicket() returns, which can delete the target file when it is readable by the PHP process, deletable under the PHP process filesystem permissions, and unserializes to a value compatible with the ?array return type. This issue has been patched in version 7.0.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| simplesamlphp | simplesamlphp-module-casserver | before 7.0.3 | 7.0.3 | Patch available | CNA |
| — | simplesamlphp/simplesamlphp-module-casserver (Packagist) | before 7.0.3 | 7.0.3 | Patch available | GHSA-jrrg-99xh-5j2q |
- simplesamlphp-module-casserver Vendorsimplesamlphp Affected before 7.0.3 Fixed in 7.0.3 Patch available CNA
- simplesamlphp/simplesamlphp-module-casserver (Packagist) Vendor— Affected before 7.0.3 Fixed in 7.0.3 Patch available GHSA-jrrg-99xh-5j2q
Remediation
- Fix · CNA simplesamlphp-module-casserver (simplesamlphp) Fixed in 7.0.3
- Fix · GHSA-jrrg-99xh-5j2q simplesamlphp/simplesamlphp-module-casserver (Packagist) Fixed in 7.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46491
- 2026-10-03 Alias added: GHSA-jrrg-99xh-5j2q
References
Other 4
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-jrrg-99xh-5j2q
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/b84f3e4ed57c4d97e0dc73df102e7eff831a681f
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/releases/tag/v7.0.3
- https://github.com/simplesamlphp/simplesamlphp-module-casserver
More simplesamlphp vulnerabilities
- TI-2025-20553 SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding CVSS 3.1HIGH 8.6
- TI-2026-25110 xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVSS 3.1HIGH 8.2
- TI-2025-40522 SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout CVSS 3.1MEDIUM 6.1
- TI-2018-04801 The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which… CVSS 3.0CRITICAL 9.8
- TI-2024-35256 SimpleSAMLphp xml-common XXE vulnerability CVSS 4.0HIGH 8.8
- TI-2017-09530 The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-46491 · CVE Program
- CVE-2026-46491 · NVD
- FIRST EPSS
- GHSA-jrrg-99xh-5j2q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences