CVE-2026-6832: Hermes WebUI Path Traversal Vulnerability

CVE-2026-6832 Overview

CVE-2026-6832 is a path traversal vulnerability in Hermes WebUI that allows authenticated attackers to delete arbitrary files on the host system. The vulnerability exists in the /api/session/delete endpoint, which fails to properly validate the session_id parameter before using it to construct file paths. Attackers can exploit this flaw by supplying an absolute path or path traversal payload (e.g., ../../../) in the session identifier to escape the intended SESSION_DIR boundary and delete writable JSON files anywhere on the system.

Critical Impact

Authenticated attackers can delete critical system or application files, leading to denial of service, data loss, or potential privilege escalation by removing security-critical configuration files.

Affected Products

• Hermes WebUI versions prior to v0.50.32
• Hermes WebUI versions prior to v0.50.132

Discovery Timeline

• 2026-04-21 - CVE-2026-6832 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6832

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The root issue lies in the session deletion functionality within Hermes WebUI, which accepts user-controlled input for the session_id parameter without adequate validation or sanitization.

When a user requests to delete a session via the /api/session/delete endpoint, the application constructs a file path by concatenating the SESSION_DIR base directory with the provided session_id value. Because the application does not verify that the resulting path remains within the intended session directory, an attacker can craft malicious input containing directory traversal sequences or absolute paths to target files outside the designated boundary.

The attack requires authentication, meaning an attacker must first obtain valid credentials or session tokens to exploit this vulnerability. Once authenticated, the attacker can systematically delete files that the web application process has write permissions to, potentially including application configuration files, cached data, or other JSON files critical to system operation.

Root Cause

The vulnerability stems from insufficient input validation in the /api/session/delete endpoint. The session_id parameter is directly incorporated into the file path construction without sanitizing path traversal sequences such as ../ or validating that the final resolved path remains within the SESSION_DIR boundary. This allows attackers to escape the intended directory scope and access the broader file system.

Attack Vector

The attack is network-accessible and requires low-privilege authentication. An attacker can exploit this vulnerability by sending a crafted HTTP request to the /api/session/delete endpoint with a malicious session_id value. For example, a payload like ../../../etc/app/config or an absolute path could be used to target files outside the session directory. The application processes this input and deletes the specified file if the web server process has sufficient permissions.

The attack does not require user interaction beyond the initial authentication. Successful exploitation can result in deletion of critical application files, leading to denial of service or potentially enabling further attacks by removing security controls or logging mechanisms.

Detection Methods for CVE-2026-6832

Indicators of Compromise

• Unexpected HTTP requests to /api/session/delete containing path traversal patterns such as ../, ..%2f, or absolute paths in the session_id parameter
• Anomalous file deletion events in application or system logs, particularly affecting files outside the expected session directory
• Missing critical configuration files or unexplained application startup failures
• Web server access logs showing repeated requests to the session deletion endpoint from unusual sources or with malformed parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal sequences in API parameters
• Monitor file system integrity using tools like AIDE or Tripwire to detect unauthorized deletions of critical files
• Configure application logging to capture all requests to the /api/session/delete endpoint with full parameter details
• Deploy endpoint detection and response (EDR) solutions to identify and alert on suspicious file deletion patterns

Monitoring Recommendations

• Enable verbose logging for the Hermes WebUI application to capture detailed request information
• Set up alerts for file deletion events outside the SESSION_DIR directory triggered by the web application process
• Monitor authentication logs for anomalous access patterns that may indicate credential compromise preceding exploitation attempts

How to Mitigate CVE-2026-6832

Immediate Actions Required

• Upgrade Hermes WebUI to version v0.50.32 or v0.50.132 or later, which contain the security fix for this vulnerability
• Review and restrict file system permissions for the web application process to minimize potential damage from arbitrary file deletion
• Audit authentication mechanisms and revoke any potentially compromised credentials
• Implement input validation at the application or WAF level to reject session identifiers containing path traversal sequences

Patch Information

The vulnerability has been addressed in Hermes WebUI. The fix was implemented via GitHub Pull Request #409 and GitHub Pull Request #412, with the security patch committed in commit 3cc5839. Patched versions are available as v0.50.32 and v0.50.132. For additional details, refer to the VulnCheck Advisory.

Workarounds

• Deploy a reverse proxy or WAF in front of Hermes WebUI to filter requests containing path traversal patterns before they reach the application
• Restrict network access to the /api/session/delete endpoint to trusted IP addresses or internal networks only
• Run the Hermes WebUI application with minimal file system privileges using a dedicated service account with limited write access
• Implement file system isolation using containers or chroot environments to limit the scope of potential file deletions