Read the docs
TI-2026-09773 Aliases CVE-2026-11322GHSA-wp87-gw3h-3hx6

Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass

Priority MEDIUM 64CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-59 and the CVSS impact.

Summary

Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files accessible to the server process and disclose sensitive data such as SSH keys, cloud credentials, or application tokens.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00323 25th percentileScored 2026-11-07
Fix Fixed Hermes WebUI (nesquena): 0.51.221

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nesquenaHermes WebUIbefore 0.51.2210.51.221Patch availableCNA
  • Hermes WebUI Vendornesquena Affected before 0.51.221 Fixed in 0.51.221 Patch available CNA

Remediation

  • Fix · CNA Hermes WebUI (nesquena) Fixed in 0.51.221

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11322
  2. 2026-10-03 Alias added: GHSA-wp87-gw3h-3hx6

References

Patch 2

  • TI-2026-36807 Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings CVSS 4.0CRITICAL 9.2
  • TI-2026-39885 Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-39878 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-39877 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-36799 Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search CVSS 4.0HIGH 7.1
  • TI-2026-41892 Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import CVSS 4.0MEDIUM 6.0
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences