SimpleSAMLphp casserver implements a CAS server using a file‑based ticket store. The module builds file paths by concatenating the ticket directory with an attacker‑controlled ticket identifier. This allows a remote user to supply a path containing traversal sequences such as '../target.serialized', which causes the CAS server to read and unserialize arbitrary files that lie outside the designated ticket directory. The same attacker‑selected path can also be passed to deleteTicket() during the CAS 1.0 validation flow, resulting in deletion of that file if it is readable, deletable by the PHP process, and unserializes into an array. The combination of arbitrary file read, potential code execution via unserialize, and conditional file deletion can compromise confidentiality, integrity, and availability.

The vulnerability affects deployments of the SimpleSAMLphp casserver module prior to version 7.0.3. Specifically, any installation that uses the FileSystemTicketStore backend is susceptible; systems that have already applied the 7.0.3 update are no longer vulnerable.

The reported CVSS score of 8.6 indicates high severity. Because the attack vector is remote and relies only on exposing public CAS validation/proxy endpoints, an attacker can trigger the exploit from outside the network. EPSS data is unavailable, but the lack of a CISA KEV listing does not reduce the potential for exploitation. An attacker only needs a crafted ticket or proxy‑ticket value; no local privileges are required, and the exploitation flow leverages standard PHP filesystem permissions. Once a ticket is resolved, the attacker may read sensitive files, trigger PHP code execution through deserialization, or delete arbitrary files, depending on the filesystem configuration.