PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22677 nesquena CVE debrief

Hermes WebUI versions prior to 0.51.44 contain a path traversal vulnerability in the session import endpoint. An authenticated attacker can exploit this by importing a crafted session with a malicious workspace value that bypasses filesystem root restrictions, then using relative paths in subsequent session file API calls to read arbitrary files accessible to the WebUI process. The vulnerability stems from insufficient validation of the workspace field during session import, allowing blocked filesystem roots to be specified. This is classified as CWE-22 (Path Traversal). The CVSS 4.0 vector indicates network attack vector, low attack complexity, privileged attacker requirement, and high confidentiality impact. The vulnerability was disclosed on May 13, 2026, with NVD record modifications on May 26, 2026. A fix is available in version 0.51.44.

Vendor
nesquena
Product
hermes-webui
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-07-14
Advisory published
2026-05-13
Advisory updated
2026-07-14

Who should care

Organizations running Hermes WebUI prior to version 0.51.44, particularly those with multi-user deployments where session sharing or import features are enabled. Security teams should prioritize patching if the WebUI process has access to sensitive configuration files, credentials, or other confidential data.

Technical summary

The vulnerability exists in the session import endpoint of Hermes WebUI. The workspace field in imported session data is not properly validated against blocked filesystem roots. An authenticated attacker can craft a session file with a malicious workspace value that bypasses these restrictions. After successful import, the attacker can leverage relative path traversal sequences in session file API calls to read arbitrary files on the underlying system with the permissions of the WebUI process. The attack requires authentication but no user interaction, with low attack complexity.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Hermes WebUI to version 0.51.44 or later to remediate the path traversal vulnerability
  • Review and restrict session import functionality to trusted administrative users until patching is complete
  • Implement additional input validation on workspace field values in session import endpoints to prevent filesystem root bypass
  • Monitor for suspicious session import activity with unusual workspace values or subsequent file API access patterns
  • Audit file system permissions to ensure the WebUI process has minimal necessary access to sensitive files

Evidence notes

Vulnerability description sourced from NVD record with CVSS 4.0 scoring. Fix confirmed via GitHub release tag v0.51.44 and associated commit f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3. Advisory published by Vulncheck. Vendor identified as Hermes WebUI project (nesquena/hermes-webui on GitHub).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-22677 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-22677

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-22677 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22677

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.