Hermes WebUI version 0 contains an arbitrary file deletion vulnerability (CWE-22) in the /api/session/delete endpoint. Authenticated attackers can supply an absolute path or path traversal payload in the session_id parameter, bypassing the SESSION_DIR restriction and deleting files outside the intended directory. This improper limitation of pathname allows deletion of writable JSON files on the host system, posing a risk to system stability and data integrity. The CVSS 4.0 score is 7.2, indicating high severity. No patch or official remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated attacker to delete arbitrary files outside the designated session directory, potentially leading to loss of important JSON configuration or data files on the host system. This could disrupt application functionality or cause data loss. The vulnerability does not allow privilege escalation or remote code execution but impacts system integrity by unauthorized file deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/session/delete endpoint to trusted users only and monitor for suspicious activity involving session_id parameters. Avoid exposing this endpoint to untrusted networks. Do not rely on user input for file path construction without validation.