PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49957 nesquena CVE debrief

CVE-2026-49957 is a MEDIUM severity vulnerability in Hermes WebUI prior to version 0.51.296. Authenticated attackers can bypass blocked-root path checks, read access to local system files through workspace file-read helpers.

Vendor
nesquena
Product
hermes-webui
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-07-14
Advisory published
2026-06-09
Advisory updated
2026-07-14

Who should care

Users of Hermes WebUI prior to version 0.51.296

Technical summary

Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows authenticated attackers to circumvent blocked-root path checks by exploiting an early return in the SSH/remote terminal profile workspace resolution logic within _remote_terminal_workspace_candidate(). Attackers can configure a remote terminal working directory to a system directory such as /etc, causing the workspace resolution path to accept it as a trusted local workspace root before the _is_blocked_workspace_path() guard executes, enabling read access to local system files through workspace file-read helpers.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade Hermes WebUI to version 0.51.296 or later.
  • Restrict access to sensitive system directories.
  • Monitor for suspicious activity in workspace file-read helpers.

Evidence notes

CVE-2026-49957 has a CVSS score of 6.3 and is classified as MEDIUM severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49957 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49957

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49957 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49957

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.