{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/serena--2.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:serena:serena:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-109965"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Serena (\u003c 2.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Serena"],"content_html":"\u003cp\u003eSerena versions before 2.0.0 are affected by an improper link resolution vulnerability identified as CVE-2026-109965. The vulnerability resides in the Project.is_path_in_project() function, which performs lexical path normalization without resolving symbolic links. An attacker can exploit this by committing malicious symlinks within a repository. When the Serena software processes these files using tools such as read_file or create_text_file, the lack of symlink resolution bypasses the intended project root boundary. This allows an unauthorized actor to perform arbitrary file reads or overwrites on sensitive system files, including SSH keys, cloud provider credentials, or configuration files, depending on the service account's permissions. This vulnerability represents a significant risk for environments where Serena processes untrusted or third-party repositories.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to gain unauthorized access to sensitive files on the underlying host. Depending on the environment, this could lead to full credential theft, persistence through the overwriting of authorized_keys files, or remote code execution by modifying sensitive configuration files. This vulnerability affects all environments deploying Serena versions prior to 2.0.0.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Serena installation to version 2.0.0 or later immediately to address the underlying symlink resolution failure.\u003c/li\u003e\n\u003cli\u003eImplement strict file system auditing on servers hosting Serena to detect unexpected file read or write activity originating from the application process.\u003c/li\u003e\n\u003cli\u003eReview repository content for suspicious symbolic link creation if the environment has processed untrusted or external codebases.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T14:39:22Z","date_published":"2026-10-13T14:39:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-serena-path-traversal/","summary":"Serena versions prior to 2.0.0 contain a path traversal vulnerability in Project.is_path_in_project() that allows attackers to access sensitive files outside the project root via malicious symlinks.","title":"Improper Link Resolution Vulnerability in Serena","url":"https://feed.craftedsignal.io/briefs/2026-10-serena-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Serena (\u003c 2.0.0)","version":"https://jsonfeed.org/version/1.1"}