CVE-2026-22677 is a path traversal vulnerability affecting nesquena's hermes-webui prior to version 0.51.44. The flaw exists in the session import endpoint where an authenticated attacker can supply a crafted session containing an unrestricted workspace value. By using a blocked filesystem root in the workspace field combined with relative paths in the session file API, the attacker can read arbitrary files that the WebUI process has permission to access. This vulnerability enables unauthorized file disclosure beyond the intended directory restrictions.

An authenticated attacker can read arbitrary files on the system accessible to the hermes-webui process by exploiting the path traversal vulnerability. This could lead to exposure of sensitive information stored on the server. The vulnerability does not allow privilege escalation or code execution based on the provided data. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the hermes-webui to trusted users only and monitor for suspicious activity related to session imports. Avoid importing sessions from untrusted sources.