{"document":{"category":"csaf_vex","csaf_version":"2.0","title":"CVE-2026-46491: SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion","publisher":{"category":"vendor","name":"HarborGuard Database","namespace":"https://database.harborguard.co"},"tracking":{"id":"CVE-2026-46491","status":"final","version":"1","initial_release_date":"2026-06-09T23:00:11.313Z","current_release_date":"2026-06-10T18:11:30.420Z","revision_history":[{"date":"2026-06-09T23:00:11.313Z","number":"1","summary":"Initial machine-readable export from HarborGuard."}]},"distribution":{"tlp":{"label":"WHITE"},"text":"Public CVE data; freely redistributable."},"notes":[{"category":"description","text":"SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query parameters into this store. In deployments using FileSystemTicketStore, a remote attacker can use path traversal sequences such as ../target.serialized to make the CAS server read and unserialize files outside the ticket directory. In the CAS 1.0 validation flow, the same attacker-selected path is also passed to deleteTicket() immediately after getTicket() returns, which can delete the target file when it is readable by the PHP process, deletable under the PHP process filesystem permissions, and unserializes to a value compatible with the ?array return type. This issue has been patched in version 7.0.3.","title":"CVE description"}],"references":[{"category":"self","summary":"CVE-2026-46491 on HarborGuard Database","url":"https://database.harborguard.co/cve/CVE-2026-46491"},{"category":"external","summary":"CVE Record","url":"https://www.cve.org/CVERecord?id=CVE-2026-46491"},{"category":"external","summary":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-jrrg-99xh-5j2q","url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-jrrg-99xh-5j2q"},{"category":"external","summary":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/b84f3e4ed57c4d97e0dc73df102e7eff831a681f","url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/b84f3e4ed57c4d97e0dc73df102e7eff831a681f"},{"category":"external","summary":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/releases/tag/v7.0.3","url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/releases/tag/v7.0.3"}]},"product_tree":{"branches":[{"category":"vendor","name":"simplesamlphp","branches":[{"category":"product_name","name":"simplesamlphp-module-casserver","branches":[{"category":"product_version","name":"< 7.0.3","product":{"name":"simplesamlphp simplesamlphp-module-casserver < 7.0.3","product_id":"CSAFPID-1","product_identification_helper":{"cpe":"cpe:2.3:a:simplesamlphp:simplesamlphp-module-casserver:\\<_7.0.3:*:*:*:*:*:*:*"}}}]}]}]},"vulnerabilities":[{"cve":"CVE-2026-46491","title":"SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion","notes":[{"category":"description","text":"SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query parameters into this store. In deployments using FileSystemTicketStore, a remote attacker can use path traversal sequences such as ../target.serialized to make the CAS server read and unserialize files outside the ticket directory. In the CAS 1.0 validation flow, the same attacker-selected path is also passed to deleteTicket() immediately after getTicket() returns, which can delete the target file when it is readable by the PHP process, deletable under the PHP process filesystem permissions, and unserializes to a value compatible with the ?array return type. This issue has been patched in version 7.0.3.","title":"CVE description"}],"product_status":{"known_affected":["CSAFPID-1"]},"scores":[{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","baseScore":8.6,"baseSeverity":"HIGH"},"products":["CSAFPID-1"]}],"remediations":[{"category":"none_available","details":"No fixed version is published yet. Monitor the upstream advisory.","product_ids":["CSAFPID-1"]}]}]}