Read the docs
TI-2026-18205 Aliases CVE-2026-22677GHSA-wvw9-5wfm-7729

Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed hermes-webui (nesquena): 0.51.44

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nesquenahermes-webuibefore 0.51.440.51.44Patch availableCNA
  • hermes-webui Vendornesquena Affected before 0.51.44 Fixed in 0.51.44 Patch available CNA

Remediation

  • Fix · CNA hermes-webui (nesquena) Fixed in 0.51.44

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22677
  2. 2026-10-03 Alias added: GHSA-wvw9-5wfm-7729

References

Patch 1

Other 2

  • TI-2026-36807 Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings CVSS 4.0CRITICAL 9.2
  • TI-2026-39885 Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-39878 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-39877 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-36799 Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search CVSS 4.0HIGH 7.1
  • TI-2026-09773 Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass CVSS 4.0HIGH 7.1
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences