PT-2026-34195 · Unknown · Hermes-Webui

Hinotoi-Agent · Published 2026-04-21 · Updated 2026-06-04 · CVE-2026-6832

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hermes WebUI (affected versions not specified)

Description An arbitrary file deletion issue exists in the '/api/session/delete' endpoint. Authenticated attackers can delete files outside the session directory by providing an absolute path or path traversal payload in the session id parameter. This occurs because unvalidated session identifiers allow the construction of paths that bypass the SESSION DIR boundary, enabling the deletion of writable JSON files on the host system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-6832

Affected Products

Hermes-Webui

References · 10

• https://github.com/nesquena/hermes-webui/pull/412 · Patch
• https://github.com/nesquena/hermes-webui/commit/3cc5839bf303fa6758bfdac538507407a2929655 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6832 · Security Note
• https://github.com/nesquena/hermes-webui/pull/409 · Patch, Vendor Advisory
• https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132 · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.50.32 · Note
• https://twitter.com/CVEnew/status/2048481088591339603 · Twitter Post
• https://t.me/cveNotify/166006 · Telegram Post
• https://twitter.com/TheRabbitPy/status/2046854041796272625 · Twitter Post
• https://vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-file-deletion-via-unvalidated-session-id · Note