Executive brief
A vulnerability in the SimpleSAMLphp CAS server module allows unauthorized users to access or delete files on the server. This module is used to handle authentication requests, and an attacker could exploit this to disrupt login services or delete critical system files. In some cases, this could lead to a complete service outage or unauthorized access to sensitive configuration data.
Technical details
A path traversal vulnerability exists in the `FileSystemTicketStore` component of the `simplesamlphp-module-casserver`. The root cause is the direct concatenation of attacker-controlled ticket identifiers from query parameters (`ticket` or `pgt`) with the configured ticket directory. A remote, unauthenticated attacker can use `../` sequences to access files outside the intended directory. If the target file contains valid PHP serialized data, the server will unserialize it; in CAS 1.0 flows, the server may also delete the file if it matches specific return type criteria. This can lead to arbitrary file deletion or potentially remote code execution if an attacker can influence the content of the files being unserialized. The issue is fixed in version 7.0.3.
Affected products
- SimpleSAMLphp simplesamlphp-module-casserver <= 7.0.2
Timeline
- 2026-05-14: patched: Version 7.0.3 released
- 2026-05-15: advisory: GitHub Advisory published
- 2026-06-10: disclosed: NVD publication