What’s Vulnerable › Vulnerabilities

CVE-2026-11322: Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-04 · updated 2026-07-22
• Weakness: CWE-59

Description

Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files accessible to the server process and disclose sensitive data such as SSH keys, cloud credentials, or application tokens.

Affected products

• nesquena Hermes WebUI: before 0.51.221 — fixed in 0.51.221

How to fix

Upgrade to a fixed version: nesquena Hermes WebUI 0.51.221. Check the vendor advisory for mitigations.

References

• https://github.com/nesquena/hermes-webui/commit/7c48c376299b8058fd35127a59aefadded7e4a92
• https://github.com/nesquena/hermes-webui/pull/3398
• https://www.vulncheck.com/advisories/hermes-webui-before-path-traversal-via-symlink-workspace-bypass
• https://github.com/nesquena/hermes-webui/pull/3398

Get alerted when CVE-2026-11322 or the next vulnerability affects your stack