CVE-2026-46491: SimpleSAMLphp-casserver Path Traversal & Arbitrary File Deletion

Technical summary

SimpleSAMLphp-casserver constructs file paths for the FileSystemTicketStore by concatenating a configured directory with user-supplied ticket identifiers without validation. The vulnerable code path affects CAS 1.0 and 2.0 protocol handlers that accept ticket and pgt (proxy-granting ticket) parameters from remote clients. An attacker can inject path traversal sequences (e.g., ../../../target.serialized) to escape the intended ticket directory. After the getTicket() call deserializes the retrieved file, a subsequent deleteTicket() call in the CAS 1.0 flow attempts to remove the file, potentially deleting sensitive data if filesystem permissions allow. Unsafe deserialization of arbitrary files compounds the risk by enabling object injection attacks if the attacker-chosen file content is crafted to match expected class signatures.

Business impact

An attacker can exfiltrate sensitive configuration files, session data, or other serialized objects stored on the affected server. In CAS 1.0 deployments, the delete operation could cause denial of service or loss of critical files depending on what the attacker targets and whether PHP process permissions allow deletion. Organizations relying on SimpleSAMLphp-casserver for authentication federation face confidentiality and integrity risks. The lack of authentication requirements means any remote actor can attempt exploitation without prior access.

Affected systems

SimpleSAMLphp-casserver versions prior to 7.0.3 are affected. The vulnerability is specific to deployments using FileSystemTicketStore (file-based ticket persistence). Organizations using alternative ticket stores (database-backed, etc.) are not exposed to this path traversal vector. Verify your deployment configuration and current version against the vendor advisory.

Exploitability

Exploitability is high: the attack requires no authentication, no user interaction, and no special network conditions. The vulnerability is in unauthenticated CAS protocol endpoints accessible to any network client. Successful exploitation depends on knowing or guessing target file paths, but common server file locations (configuration files, session directories) can be enumerated via error messages or standard directory structures. The deserialization step introduces an additional exploitation dimension if attackers can craft malicious serialized payloads.

Remediation

Upgrade SimpleSAMLphp-casserver to version 7.0.3 or later immediately. This version includes input validation to prevent path traversal sequences in ticket identifiers. After patching, review server logs for suspicious CAS validation requests containing path traversal patterns (../ sequences in ticket parameters) to detect potential exploitation attempts. Consider enforcing allowlist-based ticket identifier validation even after upgrade as a defense-in-depth measure.

Patch guidance

Apply SimpleSAMLphp-casserver version 7.0.3 or later. Verify the patch against the official SimpleSAMLphp release notes and repository. Test the upgrade in a staging environment first to ensure compatibility with your authentication flow and any custom integrations. After deployment, monitor CAS validation endpoints for error rates or unexpected behavior during the transition period.

Detection guidance

Monitor web server access logs and CAS validation endpoints for requests containing path traversal sequences in ticket or pgt parameters (look for patterns like ../, ..\ or URL-encoded equivalents %2e%2e%2f). Correlate such requests with filesystem access attempts to sensitive files. Review PHP error logs for deserialization warnings or unexpected file access attempts. Implement network-level detection for CAS protocol messages with non-alphanumeric characters in ticket identifiers that fall outside expected patterns.

Why prioritize this

This vulnerability merits immediate priority due to its high CVSS score (8.6), lack of authentication requirements, and direct impact on core authentication infrastructure. The ability to read arbitrary files threatens credential stores and session data, while the delete capability in CAS 1.0 creates availability risk. Organizations using FileSystemTicketStore should treat this as critical given the public nature of CAS endpoints and the relative ease of exploitation.

Risk score, explained

The CVSS 3.1 score of 8.6 (HIGH) reflects a network-exploitable vulnerability with low attack complexity, no privilege escalation needed, and significant impact on confidentiality (file exfiltration) and integrity (file deletion/tampering). The score appropriately captures the authentication-free nature of the vulnerable endpoints and the broad accessibility of the vulnerability to remote attackers, though it does not account for the requirement that FileSystemTicketStore be in use.

Frequently asked questions