Serena (< 2.0.0)

Serena versions prior to 2.0.0 contain a path traversal vulnerability in Project.is_path_in_project() that allows attackers to access sensitive files outside the project root via malicious symlinks.