The simplesamlphp-module-casserver, a CAS server module for SimpleSAMLphp, prior to version 7.0.3, improperly limits pathname access when handling file-based CAS ticket storage. It concatenates the configured ticket directory with attacker-controlled ticket identifiers without proper sanitization. This allows remote attackers to perform path traversal attacks by supplying crafted ticket or pgt parameters, enabling reading and unserializing files outside the intended directory. Additionally, in the CAS 1.0 validation flow, the attacker-controlled path can be used to delete arbitrary files if the PHP process has sufficient permissions. The vulnerability is addressed in version 7.0.3.

Remote attackers can exploit this vulnerability to read and unserialize arbitrary files on the server, potentially leading to information disclosure or further code execution if malicious serialized data is processed. They can also delete files accessible to the PHP process, impacting integrity and availability. The vulnerability has a high severity with a CVSS score of 8.6, reflecting its potential for significant impact without requiring authentication.

Upgrade simplesamlphp-module-casserver to version 7.0.3 or later, where this path traversal vulnerability has been patched. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version fix information.