CVE-2026-109965 Details
Description
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.
A vulnerability exists in Serena versions prior to 2.0.0, allowing for improper link resolution that can lead to unauthorized file access outside the project root. This issue arises from the application's failure to resolve symlinks correctly when normalizing file paths. As a result, file manipulation tools can inadvertently read or overwrite sensitive files, such as SSH keys or cloud credentials, by following symlinks to external locations.
Users can update to Serena version 2.0.0 or later, where this vulnerability has been fixed. The latest version can be downloaded from the GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/oraios/serena/issues/2144 | CISA-ADP | Issue TrackingTechnical DescriptionVendor |
| https://github.com/oraios/serena | [email protected] | ProductVendor |
| https://github.com/oraios/serena/blob/v1.7.0/src/serena/project.py | [email protected] | Source CodeVendor |
| https://github.com/oraios/serena/commit/6f20f9b822d85bb063008e786f808d04619dd54e | [email protected] | Source CodeVendor |
| https://github.com/oraios/serena/issues/2144 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/oraios/serena/releases/tag/v2.0.0 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/serena-before-2.0.0-symlink-following-in-file-tools-allows-access-outside-project-root | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| oraios Serena | >= 0, < 2.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |