Vulnerability · Published Jun 4, 2026 · Assigned by VulnCheck

CVE-2026-11322Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass

Medium 6.5

In plain English

A medium-severity security flaw in Hermes WebUI from nesquena. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 74.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files accessible to the server process and disclose sensitive data such as SSH keys, cloud credentials, or application tokens.

Affected products (as reported)

Vendor	Product	Versions
nesquena	Hermes WebUI	0 – before 0.51.221

Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/nesquena/hermes-webui/pull/3398 issue-tracking
https://github.com/nesquena/hermes-webui/commit/7c48c376299b8058fd35127a59aefadded7e4a92 patch
https://www.vulncheck.com/advisories/hermes-webui-before-path-traversal-via-symlink-workspace-bypass third-party-advisory