CVE-2026-49957 is a path traversal vulnerability in nesquena's Hermes WebUI prior to version 0.51.296. The issue arises from a workspace boundary bypass caused by an early return in the _remote_terminal_workspace_candidate() function during SSH/remote terminal profile workspace resolution. This flaw allows authenticated attackers to circumvent blocked-root path checks by configuring the remote terminal working directory to a system directory such as /etc. Consequently, the workspace resolution path accepts this directory as a trusted local workspace root before the _is_blocked_workspace_path() guard executes, enabling unauthorized read access to local system files via workspace file-read helpers.

Authenticated attackers can bypass workspace path restrictions to read sensitive local system files, potentially exposing confidential information. The vulnerability does not require user interaction and has a medium severity with a CVSS 4.0 base score of 6.3. There is no indication of privilege escalation, remote code execution, or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to limit access to the remote terminal feature and monitor for suspicious activity related to workspace path configurations. Avoid exposing Hermes WebUI instances to untrusted networks if possible.