Vulnerability · Published Apr 21, 2026 · Assigned by VulnCheck

CVE-2026-6829nesquena hermes-webui Arbitrary Workspace Directory Access

Medium 6.3

In plain English

A medium-severity path traversal in hermes-webui from nesquena. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 82.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating workspace path parameters in endpoints such as /api/session/new, /api/session/update, /api/chat/start, and /api/workspaces/add. Attackers can repoint a session workspace to a directory outside the intended trusted root and then use ordinary file read and write APIs to access or modify files outside the intended workspace boundary within the permissions of the hermes-webui process.

Affected products (as reported)

Vendor	Product	Versions
nesquena	hermes-webui	0 – before PR #416

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Pull Request issue-tracking
Patch Commit patch
Release Notes release-notes
https://www.vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-workspace-directory-access third-party-advisory