CVE-2026-109965 — Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository.…
Published: 2026-10-13 · CVSS: 8.4 · CVSS 4.0
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7