CVE-2026-6829
nesquena hermes-webui Arbitrary Workspace Directory Access
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating workspace path parameters in endpoints such as /api/session/new, /api/session/update, /api/chat/start, and /api/workspaces/add. Attackers can repoint a session workspace to a directory outside the intended trusted root and then use ordinary file read and write APIs to access or modify files outside the intended workspace boundary within the permissions of the hermes-webui process.
| CWE | CWE-22 |
| Vendor | nesquena |
| Product | hermes-webui |
| Published | Apr 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for nesquena hermes-webui
Be the first to know when new medium vulnerabilities affecting nesquena hermes-webui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
nesquena / hermes-webui
0 < PR #416
References
github.com: https://github.com/nesquena/hermes-webui/pull/416 github.com: https://github.com/nesquena/hermes-webui/commit/2a7a5ddfaf39e3b0094b7ac37e9f1dbcf40a3918 github.com: https://github.com/nesquena/hermes-webui/releases/tag/v0.50.34 vulncheck.com: https://www.vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-workspace-directory-access
Credits
Chia Min Jun Lennon