CVE-2026-11322

Published: Giu 05, 2026 Last Modified: Giu 05, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,1
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 6,5
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files accessible to the server process and disclose sensitive data such as SSH keys, cloud credentials, or application tokens.

59

Improper Link Resolution Before File Access ('Link Following')

Draft
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control Other
Potential Impacts:
Read Files Or Directories Modify Files Or Directories Bypass Protection Mechanism Execute Unauthorized Code Or Commands
Applicable Platforms
Operating Systems: Windows, Unix
View CWE Details
https://github.com/nesquena/hermes-webui/commit/7c48c376299b8058fd35127a59aefad…
https://github.com/nesquena/hermes-webui/pull/3398
https://www.vulncheck.com/advisories/hermes-webui-before-path-traversal-via-sym…