Read the docs
TI-2026-36801 Aliases CVE-2026-49958GHSA-qg92-vxjm-x4q9

Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discard

Priority MEDIUM 53CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git_discard function within api/workspace_git.py that allows attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink after validation but before deletion. Attackers can substitute a workspace-controlled path component with a symlink pointing to an external directory between the safe_resolve_ws() validation step and the subsequent Path.unlink() or shutil.rmtree() deletion call, causing the delete operation to follow the symlink and remove arbitrary files outside the workspace.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00081 0th percentileScored 2026-11-07
Fix Fixed hermes-webui (nesquena): 0.51.303

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nesquenahermes-webuibefore 0.51.3030.51.303Patch availableCNA
  • hermes-webui Vendornesquena Affected before 0.51.303 Fixed in 0.51.303 Patch available CNA

Remediation

  • Fix · CNA hermes-webui (nesquena) Fixed in 0.51.303

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49958
  2. 2026-10-03 Alias added: GHSA-qg92-vxjm-x4q9

References

Patch 1

Other 3

  • TI-2026-36807 Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings CVSS 4.0CRITICAL 9.2
  • TI-2026-39885 Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-39878 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-39877 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-36799 Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search CVSS 4.0HIGH 7.1
  • TI-2026-09773 Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass CVSS 4.0HIGH 7.1
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences