The vulnerability in hermes-webui arises from improper limitation of pathname inputs (CWE-22) in the /api/session/delete endpoint. Authenticated users can supply an absolute path or path traversal payload in the session_id parameter, bypassing the SESSION_DIR boundary and deleting files outside the intended directory. This arbitrary file deletion flaw affects version 0 of the product and has a CVSS 4.0 score of 7.2, indicating high severity.

Successful exploitation allows an authenticated attacker to delete arbitrary writable JSON files on the host system outside the designated session directory. This can disrupt application functionality or cause data loss. There is no indication of remote code execution or privilege escalation from the provided data.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor advisory for updates. Until a fix is released, restrict access to the /api/session/delete endpoint to trusted users only and consider implementing additional input validation or access controls to limit session_id parameter values.