CVE-2026-46491 SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
Remote attackers can read and delete arbitrary files via path traversal in the CAS ticket store, requiring FileSystemTicketStore configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46491?
CVE-2026-46491 is a high-severity path traversal vulnerability in simplesamlphp-module-casserver, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query parameters into this store. In deployments using FileSystemTicketStore, a remote attacker can use path traversal sequences such as ../target.serialized to make the CAS server read and unserialize files outside the ticket directory. In the CAS 1.0 validation flow, the same attacker-selected path is also passed to deleteTicket() immediately after getTicket() returns, which can delete the target file when it is readable by the PHP process, deletable under the PHP process filesystem permissions, and unserializes to a value compatible with the ?array return type. This issue has been patched in version 7.0.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-46491?
2 open source packages ship an affected version, including simplesamlphp/simplesamlphp-module-casserver.
| Package | Affected | Fixed in |
|---|---|---|
simplesamlphp/simplesamlphp-module-casserver Packagist | All versions | 7.0.3 |
simplesamlphp/simplesamlphp-module-casserver Packagist | All versions | 7.0.3 |
How do I fix CVE-2026-46491?
Upgrade simplesamlphp/simplesamlphp-module-casserver to 7.0.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-46491 being exploited?
There is no known exploitation of CVE-2026-46491 in the wild and no public exploit code.
Sources
Also known as GHSA-jrrg-99xh-5j2q.