Serena versions prior to .0.0 contain an improper link resolution flaw that permits malicious construction of symbolic links inside a repository. The project.is_path_in_project() routine normalizes paths without following symlinks, so the file tools read_file and create_text_file can resolve those links. As a result an attacker who can commit a symlink may read or overwrite system files beyond the project root, such as SSH keys or cloud credentials, compromising confidentiality and potentially the integrity of critical services.

The vulnerability affects the Serena project hosting platform maintained by oraios. All deployed instances of Serena released before version 2.0.0 are susceptible; no specific sub‑versions are listed beyond this boundary.

The CVSS vector scores 8.4, indicating a high‑severity flaw. EPSS data is presently unavailable, and the vulnerability is not cataloged in KEV. Exploitation requires write access to the repository to introduce a symlink that points outside the intended directory tree. An externally exposed repository can be abused by a remote actor; internal users with commit rights may also leverage the flaw to exfiltrate sensitive configuration or credential files.