CVE-2026-46491

🗓️ 09 Jun 2026 23:00:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 81 Views🌐 WEB

CVE-2026-46491 SimpleSAMLphp casserver path traversal reads and unserializes outside the ticket directory and may delete files; fixed in 7.0.3.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-46491	10 Jun 202600:48	–	circl
CNNVD	SimpleSAMLphp-casserver: Path traversal vulnerability	10 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-46491 SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion	9 Jun 202623:00	–	cvelist
EUVD	EUVD-2026-35871	9 Jun 202623:00	–	euvd
Github Security Blog	SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion	15 May 202618:07	–	github
Mend	CVE-2026-46491	9 Jun 202623:00	–	mend
NVD	CVE-2026-46491	10 Jun 202600:16	–	nvd
osv_ghsa	GHSA-JRRG-99XH-5J2Q SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion	15 May 202618:07	–	osv_ghsa
Positive Technologies	PT-2026-41399	15 May 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-46491: Improper Limitation of a Pathname to a Restricted Directory	10 Jun 202600:00	–	rapid7

Vulners

Node

simplesamlphp simplesamlphp-module-casserverRange<7.0.3

[
  {
    "vendor": "simplesamlphp",
    "product": "simplesamlphp-module-casserver",
    "versions": [
      {
        "version": "< 7.0.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/simplesamlphp/simplesamlphp-module-casserver/commit/b84f3e4ed57c4d97e0dc73df102e7eff831a681f
github	www.github.com/simplesamlphp/simplesamlphp-module-casserver/releases/tag/v7.0.3
github	www.github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-jrrg-99xh-5j2q

Parameter	Position	Path	Description	CWE
ticket	query param	/cas/service	Path traversal in the ticket or pgt query parameters allows an attacker to read and unserialize files outside the ticket directory via the FileSystemTicketStore.	CWE-22
pgt	query param	/cas/service	Path traversal in the ticket or pgt query parameters allows an attacker to read and unserialize files outside the ticket directory via the FileSystemTicketStore.	CWE-22

23 Jul 2026 09:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.6

EPSS0.00422

SSVC

CWE-22