CVE-2026-109965
7.1 HIGHpublic exploit availablePublished 2026-10-13 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-59
Public exploit & PoC references
- https://github.com/oraios/serena
- https://github.com/oraios/serena/blob/v1.7.0/src/serena/project.py
- https://github.com/oraios/serena/commit/6f20f9b822d85bb063008e786f808d04619dd54e
- https://github.com/oraios/serena/issues/2144
- https://github.com/oraios/serena/releases/tag/v2.0.0
- https://github.com/oraios/serena/issues/2144
All references
- https://github.com/oraios/serena
- https://github.com/oraios/serena/blob/v1.7.0/src/serena/project.py
- https://github.com/oraios/serena/commit/6f20f9b822d85bb063008e786f808d04619dd54e
- https://github.com/oraios/serena/issues/2144
- https://github.com/oraios/serena/releases/tag/v2.0.0
- https://www.vulncheck.com/advisories/serena-before-2.0.0-symlink-following-in-file-tools-allows-access-outside-project-root
- https://github.com/oraios/serena/issues/2144
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100419PoC
- HIGHCVE-2026-100690PoC
- HIGHCVE-2026-100692PoC
- CRITICALCVE-2026-100715PoC
- CRITICALCVE-2026-100716PoC
- HIGHCVE-2026-100838PoC
- CRITICALCVE-2026-101894PoC
- HIGHCVE-2026-102113PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.