Arbitrary File Deletion Vulnerability in Hermes WebUI by Nesquena

CVE-2026-6832

What is CVE-2026-6832?

The Hermes WebUI software is affected by a vulnerability that permits authenticated attackers to delete files beyond the designated session directory. By leveraging unvalidated session identifiers, attackers can exploit the /api/session/delete endpoint with absolute paths or maliciously constructed path traversal inputs. This oversight allows unauthorized file deletion, which poses significant security risks as it can impact the integrity of JSON files stored on the host system. It is crucial for users of Hermes WebUI to apply the latest patches to mitigate this issue.

References