CVE-2026-22677

Medium

Description

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.

SeverityMedium

CVSS6.5

Exploit probability—

ProductNesquena Hermes-webui

PublishedMay 13, 2026

First seenMay 13, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

nesquena hermes-webui0.51.44 or later

Patches

github.com/nesquena/hermes-webui/commit/f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3

Vendor advisories

github.com/nesquena/hermes-webui/releases/tag/v0.51.44

Affected products

Product	Affected versions	Fixed in
nesquena hermes-webui	v < 0.51.44	0.51.44

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.