PT-2026-48120 · Nesquena · Hermes-Webui

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-49958

NVD

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H

Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git discard function within api/workspace git.py that allows attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink after validation but before deletion. Attackers can substitute a workspace-controlled path component with a symlink pointing to an external directory between the safe resolve ws() validation step and the subsequent Path.unlink() or shutil.rmtree() deletion call, causing the delete operation to follow the symlink and remove arbitrary files outside the workspace.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-49958

Affected Products

Hermes-Webui

References · 6

• https://github.com/nesquena/hermes-webui/commit/4580f584964d640b95c4ffc9245a21ab926bec73 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49958 · Security Note
• https://github.com/nesquena/hermes-webui/pull/3702 · Note
• https://vulncheck.com/advisories/hermes-webui-toctou-race-condition-via-git-discard · Note
• https://github.com/nesquena/hermes-webui/pull/3756 · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.303 · Note