CVE-2026-49957High· 7.7▾ TwilightHermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows authenticated attackers to circumvent blocked-root path checks by exploiting an early return in the SSH/remote terminal profile workspace…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows authenticated attackers to circumvent blocked-root path checks by exploiting an early return in the SSH/remote terminal profile workspace resolution logic within _remote_terminal_workspace_candidate(). Attackers can configure a remote terminal working directory to a system directory such as /etc, causing the workspace resolution path to accept it as a trusted local workspace root before the _is_blocked_workspace_path() guard executes, enabling read access to local system files through workspace file-read helpers.
hermes-webui < 0.51.296Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22677Medium· 6.5Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint
CVE-2026-6829Medium· 6.3nesquena hermes-webui Arbitrary Workspace Directory Access
CVE-2026-6832High· 8.1Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id
CVE-2026-49956Medium· 6.5Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search
CVE-2026-49955Medium· 5.3Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options
CVE-2026-49959High· 8.8Hermes WebUI < 0.51.311 RCE via Git Configuration Injection