Packagist/simplesamlphp/simplesamlphp-module-casserver CVE-2026-46491: high 8.6, EPSS 0.62%
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
Action: Upgrade simplesamlphp/simplesamlphp-module-casserver to 7.0.3 or later.
composer require simplesamlphp/simplesamlphp-module-casserver:7.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.0.3 | - |
Fixed versions
| 7.0.3 |
Sources
- osv: GHSA-jrrg-99xh-5j2q
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-jrrg-99xh-5j2q
- https://nvd.nist.gov/vuln/detail/CVE-2026-46491
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/b84f3e4ed57c4d97e0dc73df102e7eff831a681f
- https://github.com/simplesamlphp/simplesamlphp-module-casserver
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/releases/tag/v7.0.3
CVE-2026-46491 · published · modified · JSON