CVE-2026-22677: Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint
Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hermes WebUIto a version that resolves this vulnerability.Fixed in 0.51.44 - Compensating control
Ensure only trusted, authenticated users can access the Hermes WebUI session import endpoint, since the vulnerability affects authenticated attackers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22677?
CVE-2026-22677 is considered a medium severity vulnerability due to its potential exploitation by authenticated attackers.
How do I fix CVE-2026-22677?
To fix CVE-2026-22677, upgrade Hermes WebUI to version 0.51.44 or later.
What type of vulnerability is CVE-2026-22677?
CVE-2026-22677 is a path traversal vulnerability affecting the session import endpoint.
Who is affected by CVE-2026-22677?
Hermes WebUI versions prior to 0.51.44 are affected by CVE-2026-22677.
What can an attacker achieve by exploiting CVE-2026-22677?
An attacker can read arbitrary files on the server by importing a crafted session through the vulnerable endpoint.