Hermes Web UI vulnerabilities

1 known vulnerability in Hermes Web UI from Get-hermes. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  hermes-webui: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-6832Apr 21, 2026Nesquena

  Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute path or path traversal payload in the session_id param