CVE-2026-22677: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in nesquena hermes-webui
CVE-2026-22677 is a path traversal vulnerability in nesquena's Hermes WebUI prior to version 0. 51. 44 - Release T. It affects the session import endpoint, allowing authenticated users to read arbitrary files by importing a crafted session with a manipulated workspace value. This enables attackers to bypass directory restrictions and access any file readable by the WebUI process using relative paths. The vulnerability has a CVSS 4. 0 base score of 6. 0, indicating medium severity.
AI Analysis
Technical Summary
Hermes WebUI versions before 0.51.44 - Release T contain a path traversal vulnerability in the session import endpoint. Authenticated attackers can exploit this by supplying a blocked filesystem root in the workspace field and using relative paths in the session file API to read arbitrary files accessible to the WebUI process. This improper limitation of pathname to a restricted directory allows unauthorized file disclosure.
Potential Impact
An authenticated attacker can read arbitrary files on the system with the privileges of the Hermes WebUI process. This may lead to unauthorized disclosure of sensitive information accessible to the application. There is no indication of remote code execution or privilege escalation in the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided information. Until a patch is available, restrict access to the session import functionality to trusted users only and monitor for suspicious activity related to session imports.
CVE-2026-22677: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in nesquena hermes-webui
Description
CVE-2026-22677 is a path traversal vulnerability in nesquena's Hermes WebUI prior to version 0. 51. 44 - Release T. It affects the session import endpoint, allowing authenticated users to read arbitrary files by importing a crafted session with a manipulated workspace value. This enables attackers to bypass directory restrictions and access any file readable by the WebUI process using relative paths. The vulnerability has a CVSS 4. 0 base score of 6. 0, indicating medium severity.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Hermes WebUI versions before 0.51.44 - Release T contain a path traversal vulnerability in the session import endpoint. Authenticated attackers can exploit this by supplying a blocked filesystem root in the workspace field and using relative paths in the session file API to read arbitrary files accessible to the WebUI process. This improper limitation of pathname to a restricted directory allows unauthorized file disclosure.
Potential Impact
An authenticated attacker can read arbitrary files on the system with the privileges of the Hermes WebUI process. This may lead to unauthorized disclosure of sensitive information accessible to the application. There is no indication of remote code execution or privilege escalation in the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided information. Until a patch is available, restrict access to the session import functionality to trusted users only and monitor for suspicious activity related to session imports.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-01-08T19:04:26.365Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a04cf37cbff5d86100040a3
Added to database: 5/13/2026, 7:21:27 PM
Last enriched: 5/13/2026, 7:36:42 PM
Last updated: 5/13/2026, 8:33:57 PM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.