Serena (< 2.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/serena--2.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 13 Oct 2026 14:39:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Link Resolution Vulnerability in Serenahttps://feed.craftedsignal.io/briefs/2026-10-serena-path-traversal/Tue, 13 Oct 2026 14:39:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-serena-path-traversal/Serena versions prior to 2.0.0 contain a path traversal vulnerability in Project.is_path_in_project() that allows attackers to access sensitive files outside the project root via malicious symlinks.Serena versions before 2.0.0 are affected by an improper link resolution vulnerability identified as CVE-2026-109965. The vulnerability resides in the Project.is_path_in_project() function, which performs lexical path normalization without resolving symbolic links. An attacker can exploit this by committing malicious symlinks within a repository. When the Serena software processes these files using tools such as read_file or create_text_file, the lack of symlink resolution bypasses the intended project root boundary. This allows an unauthorized actor to perform arbitrary file reads or overwrites on sensitive system files, including SSH keys, cloud provider credentials, or configuration files, depending on the service account's permissions. This vulnerability represents a significant risk for environments where Serena processes untrusted or third-party repositories.

Impact

Successful exploitation allows attackers to gain unauthorized access to sensitive files on the underlying host. Depending on the environment, this could lead to full credential theft, persistence through the overwriting of authorized_keys files, or remote code execution by modifying sensitive configuration files. This vulnerability affects all environments deploying Serena versions prior to 2.0.0.

Recommendation

  • Upgrade the Serena installation to version 2.0.0 or later immediately to address the underlying symlink resolution failure.
  • Implement strict file system auditing on servers hosting Serena to detect unexpected file read or write activity originating from the application process.
  • Review repository content for suspicious symbolic link creation if the environment has processed untrusted or external codebases.
]]>highadvisory