PT-2026-40774 · Unknown · Hermes-Webui

Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-22677

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.44 Release T

Description A path traversal issue exists in the session import endpoint. Authenticated attackers can read arbitrary files by importing a crafted session containing an unrestricted workspace value. By supplying a blocked filesystem root in the workspace field and using relative paths in the session file API, an attacker can access any file readable by the WebUI process.

Recommendations Update to version 0.51.44 Release T or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-22677

Affected Products

Hermes-Webui

References · 6

• 🔥 https://github.com/nesquena/hermes-webui/pull/2048 · Exploit
• https://github.com/nesquena/hermes-webui/commit/f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22677 · Security Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.44 · Note
• https://twitter.com/VulmonFeeds/status/2054722078780096818 · Twitter Post
• https://vulncheck.com/advisories/hermes-webui-path-traversal-via-session-import-endpoint · Note