CVE-2026-46491

## Summary `simplesamlphp-module-casserver` builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled `ticket` / `pgt` query parameters into this store. In deployments using `FileSystemTicketStore`, a remote attacker can use path traversal sequences such as `../target.serialized` to make the CAS server read and unserialize files outside the ticket directory. In the CAS 1.0 validation flow, the same attacker-selected path is also passed to `deleteTicket()` immediately after `getTicket()` returns, which can delete the target file when it is readable by the PHP process, deletable under the PHP process filesystem permissions, and unserializes to a value compatible with the `?array` return type. ### Preconditions The demonstrated issue requires: - the `casserver` module to be enabled; - the file-based ticket store to be configured (`FileSystemTicketStore`); - public CAS validation/proxy endpoints to be reachable; - the PHP process to have filesystem permissions for the target path. - for the demonstrated CAS 1.0 deletion impact, `getTicket()` must return without throwing; practically, the target file must contain serialized PHP data that unserializes to a value compatible with the `?array` return type, such as an array or null. Full CAS semantic validation is not required for deletion in CAS 1.0 because `deleteTicket($ticket)` is called immediately after `getTicket($ticket)`. The attacker does not need administrator access to SimpleSAMLphp. ## Impact Affected deployments can allow remote attackers to escape the configured CAS ticket directory through public ticket validation inputs. Confirmed impact: - read and unserialize files outside the ticket cache when the file content is valid serialized PHP data; - delete attacker-selected files outside the ticket cache through the CAS 1.0 validation flow whe