CVE-2026-11322: Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass
Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files accessible to the server process and disclose sensitive data such as SSH keys, cloud credentials, or application tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hermes WebUIto a version that resolves this vulnerability.Fixed in 0.51.221 - Compensating control
Enforce server-side checks to ensure any resolved symlink target path remains within the designated workspace root (workspace boundary enforcement) to prevent symlink workspace bypass.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11322?
CVE-2026-11322 has a medium severity rating of 6.5.
What does CVE-2026-11322 exploit?
CVE-2026-11322 exploits a path traversal vulnerability in Hermes WebUI via symlink workspace bypass.
How do I fix CVE-2026-11322?
To fix CVE-2026-11322, update Hermes WebUI to version 0.51.221 or later.
What are the consequences of CVE-2026-11322?
The consequences of CVE-2026-11322 include unauthorized access to files or directories outside the designated workspace root.
Where can I find more information about CVE-2026-11322?
More information about CVE-2026-11322 can be found in the release notes and commits of Hermes WebUI.