CVE-2026-22677CWE-22

Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint

Medium · published May 13, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00376 · 30.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-13T19:08Z
EPSS history
Timeline
  • 13 MAY 19:08Z
    Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint
    cvelistv5