High severity8.1NVD Advisory· Published Apr 21, 2026· Updated Jun 4, 2026
CVE-2026-6832
CVE-2026-6832
Description
Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute path or path traversal payload in the session_id parameter. Attackers can exploit unvalidated session identifiers to construct paths that bypass the SESSION_DIR boundary and delete writable JSON files on the host system.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)
Patches
Vulnerability mechanics
References
6- github.com/nesquena/hermes-webui/commit/3cc5839bf303fa6758bfdac538507407a2929655nvdPatch
- github.com/nesquena/hermes-webui/pull/409nvdIssue TrackingPatchExploitVendor Advisory
- github.com/nesquena/hermes-webui/pull/412nvdIssue TrackingPatch
- www.vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-file-deletion-via-unvalidated-session-idnvdThird Party Advisory
- github.com/nesquena/hermes-webui/releases/tag/v0.50.132nvdProductRelease Notes
- github.com/nesquena/hermes-webui/releases/tag/v0.50.32nvdProductRelease Notes
News mentions
0No linked articles in our index yet.