---
id: CVE-2026-22677
title: Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint
summary: >-
  Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the
  session import endpoint that allows authenticated attackers to read arbitrary
  files by importing a crafted session with an unrestricted workspace value.
  Attacke…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: nesquena
product: hermes-webui
affected:
  - hermes-webui < 0.51.44
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-14T12:45:26.899359Z'
published: '2026-05-13'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:01:18.590Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22677'
references:
  - url: 'https://github.com/nesquena/hermes-webui/releases/tag/v0.51.44'
    label: hermes-webui 0.51.44 Release Notes
  - url: 'https://github.com/nesquena/hermes-webui/pull/2048'
  - url: >-
      https://github.com/nesquena/hermes-webui/commit/f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3
  - url: >-
      https://www.vulncheck.com/advisories/hermes-webui-path-traversal-via-session-import-endpoint
tags:
  - cve.org
epss: 0.00376
epssPercentile: 0.31794
ingestedAt: '2026-11-08T14:51:22.474Z'
---

## Overview

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.

## Affected

- `hermes-webui < 0.51.44`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.