CVE-2026-109965CWE-59

CVE-2026-109965

High · published October 13, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
8.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00223 · 12.2th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-10-13T18:17Z
References (7)
https://github.com/oraios/serena · [email protected]https://github.com/oraios/serena/blob/v1.7.0/src/serena/project.py · [email protected]https://github.com/oraios/serena/commit/6f20f9b822d85bb063008e786f808d04619dd54e · [email protected]https://github.com/oraios/serena/issues/2144 · [email protected]https://github.com/oraios/serena/releases/tag/v2.0.0 · [email protected]https://www.vulncheck.com/advisories/serena-before-2.0.0-symlink-following-in-file-tools-allows-access-outside-project-root · [email protected]https://github.com/oraios/serena/issues/2144 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 13 OCT 14:00Z
    Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
    cvelistv5
  • 13 OCT 14:00Z
    Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
    cvelistv5