Vulnerability · Published May 13, 2026 · Assigned by VulnCheck

CVE-2026-22677Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint

Medium 6.5

In plain English

A medium-severity path traversal in hermes-webui from nesquena. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 68.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.

Affected products (as reported)

Vendor	Product	Versions
nesquena	hermes-webui	0 – before 0.51.44

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/nesquena/hermes-webui/releases/tag/v0.51.44 release-notes
https://github.com/nesquena/hermes-webui/pull/2048 issue-tracking
https://github.com/nesquena/hermes-webui/commit/f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3 patch
https://www.vulncheck.com/advisories/hermes-webui-path-traversal-via-session-import-endpoint third-party-advisory