The vulnerability exists due to improper limitation of pathname inputs (CWE-22) in the hermes-webui product by nesquena. Authenticated users can supply an absolute path or path traversal payload in the session_id parameter to the /api/session/delete API endpoint, bypassing the SESSION_DIR boundary. This enables deletion of files outside the intended directory, potentially impacting system integrity by removing writable JSON files on the host. The CVSS 4.0 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and availability. No patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated attacker to delete arbitrary files on the host system outside the designated session directory. This can lead to loss of important JSON configuration or data files, potentially disrupting application functionality or causing data loss. The vulnerability impacts confidentiality and availability with high severity as per CVSS 4.0 scoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/session/delete endpoint to trusted users only and monitor for suspicious activity involving session_id parameters. Consider implementing additional input validation or web application firewall rules to block path traversal payloads targeting this endpoint.