CVE-2026-22677 is a path traversal vulnerability in nesquena's Hermes WebUI before version 0.51.44. The issue exists in the session import endpoint, where an authenticated attacker can supply a workspace field containing a blocked filesystem root and relative paths. This allows reading arbitrary files accessible by the WebUI process, bypassing intended directory restrictions. The vulnerability requires low attack complexity and privileges but no user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, partial privileges, no user interaction, and high impact on confidentiality.

An authenticated attacker can read arbitrary files on the system where Hermes WebUI runs by exploiting the path traversal vulnerability. This could lead to disclosure of sensitive information accessible by the WebUI process. There is no indication of privilege escalation, integrity, or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the session import endpoint to trusted users only and monitor for suspicious use of the workspace parameter. Avoid importing sessions from untrusted sources.