CVE-2026-6832

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-6832
Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute path or path traversal payload in the session_id parameter. Attackers can exploit unvalidated session identifiers to construct paths that bypass the SESSION_DIR boundary and delete writable JSON files on the host system.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/nesquena/hermes-webui/commit/3cc5839bf303fa6758bfdac538507407a2929655 Patch
https://github.com/nesquena/hermes-webui/pull/409 Issue Tracking Patch Exploit Vendor Advisory
https://github.com/nesquena/hermes-webui/pull/412 Issue Tracking Patch
https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132 Product Release Notes
https://github.com/nesquena/hermes-webui/releases/tag/v0.50.32 Product Release Notes
https://www.vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-file-deletion-via-unvalidated-session-id Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:get-hermes:hermes_web_ui:*:*:*:*:*:*:*:*
History

04 Jun 2026, 15:11

Type Values Removed Values Added
References () https://github.com/nesquena/hermes-webui/commit/3cc5839bf303fa6758bfdac538507407a2929655 - () https://github.com/nesquena/hermes-webui/commit/3cc5839bf303fa6758bfdac538507407a2929655 - Patch
References () https://github.com/nesquena/hermes-webui/pull/409 - () https://github.com/nesquena/hermes-webui/pull/409 - Issue Tracking, Patch, Exploit, Vendor Advisory
References () https://github.com/nesquena/hermes-webui/pull/412 - () https://github.com/nesquena/hermes-webui/pull/412 - Issue Tracking, Patch
References () https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132 - () https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132 - Product, Release Notes
References () https://github.com/nesquena/hermes-webui/releases/tag/v0.50.32 - () https://github.com/nesquena/hermes-webui/releases/tag/v0.50.32 - Product, Release Notes
References () https://www.vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-file-deletion-via-unvalidated-session-id - () https://www.vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-file-deletion-via-unvalidated-session-id - Third Party Advisory
CPE cpe:2.3:a:get-hermes:hermes_web_ui:*:*:*:*:*:*:*:*
First Time Get-hermes
Get-hermes hermes Web Ui

21 Apr 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-21 22:16

Updated : 2026-06-04 15:11

NVD link : CVE-2026-6832

Mitre link : CVE-2026-6832

CVE.ORG link : CVE-2026-6832

JSON object : View

Products Affected

get-hermes

  • hermes_web_ui
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')