CVE-2026-11322 is a CWE-59 Improper Link Resolution Before File Access vulnerability in nesquena Hermes WebUI before version 0.51.221. The vulnerability arises because the workspace file and listing APIs resolve symbolic link targets without verifying that the final resolved path remains within the workspace boundary. This allows an attacker with limited privileges to craft symlinks that point outside the workspace root, leading to path traversal and unauthorized disclosure of files accessible to the server process. The vulnerability can be exploited to read sensitive host files such as SSH keys, cloud credentials, or application tokens. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

An attacker with limited privileges can exploit this vulnerability to read arbitrary files on the host system that are accessible to the Hermes WebUI server process. This can lead to disclosure of sensitive information including SSH keys, cloud credentials, and application tokens, potentially compromising system security and confidentiality. The vulnerability does not impact integrity or availability directly but poses a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Hermes WebUI service to trusted users only and monitor for suspicious activity involving symlink usage. Avoid exposing the service to untrusted networks or users. Follow the vendor's updates for an official patch or mitigation instructions.