CVE-2026-8757

Vulnerability

The vulnerability resides in the handle_delete_history_session handler within core/framework/server/routes_sessions.py. The function directly uses the session_id parameter from the request URL without proper sanitization, allowing path traversal sequences (e.g., %2E%2E%2F). When concatenated with the base path, this results in an arbitrary directory being passed to shutil.rmtree(), which recursively deletes the target directory [1].

Exploitation

An unauthenticated attacker can send a DELETE request to /api/sessions/history/{session_id} with a crafted session_id containing URL-encoded traversal sequences. The aiohttp framework automatically decodes these sequences, so a payload like %2E%2E%2F%2E%2E%2Ftmp%2Fpwned resolves to ../../tmp/pwned. The application then deletes the resolved directory, which can be any location the process has write access to [1].

Impact

Successful exploitation allows arbitrary directory deletion on the host filesystem. This can lead to severe data loss, corruption of application functionality, and denial of service. The attack requires no authentication and can be executed remotely, making it highly dangerous [1].

Mitigation

As of the disclosure, the vendor has not responded, and no patch is available. Users of Hive up to version 0.11.0 should apply input validation on the session_id parameter or restrict access to the endpoint. Since the exploit is public, immediate action is recommended [1].