Is there a patch available for CVE-2026-6829?

Yes, a patch is available for CVE-2026-6829. Update the affected software to the latest version immediately.

hermes-webui CVE-2026-6829

Q: What is the CVSS score of CVE-2026-6829?

CVE-2026-6829 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-24506 MEDIUM

Path Traversal (CWE-22)

2026-04-21 VulnCheck

GHSA-rppv-5944-crmm

Path Traversal Hermes Webui Nesquena

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network endpoints require an authenticated session (PR:L); path traversal escapes the application workspace boundary (S:C), enabling full read and write of arbitrary OS files (C:H/I:H); availability impact is secondary and partial (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:H/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:34 vuln.today

Analysis Generated

Jul 24, 2026 - 05:34 vuln.today

CVSS changed

Apr 21, 2026 - 22:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 21, 2026 - 22:16 euvd

EUVD-2026-24506

Patch released

Apr 21, 2026 - 22:16 nvd

Patch available

CVE Published

Apr 21, 2026 - 21:09 nvd

MEDIUM 5.3

DescriptionCVE.org

nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating workspace path parameters in endpoints such as /api/session/new, /api/session/update, /api/chat/start, and /api/workspaces/add. Attackers can repoint a session workspace to a directory outside the intended trusted root and then use ordinary file read and write APIs to access or modify files outside the intended workspace boundary within the permissions of the hermes-webui process.

AnalysisAI

Path traversal in nesquena hermes-webui allows any authenticated user to redirect a session workspace to an arbitrary existing directory on the host filesystem by supplying attacker-controlled paths to four POST endpoints. Once the workspace is redirected, the attacker leverages the application's own file read and write APIs to access or modify files well outside the intended workspace sandbox, bounded only by the OS-level permissions of the hermes-webui process. No public exploit is identified at time of analysis and this is not listed in CISA KEV; vendor-patched release v0.50.34 is available.

Technical ContextAI

hermes-webui (CPE: cpe:2.3:a:nesquena:hermes-webui:*:*:*:*:*:*:*:*) is a web-based UI for AI agent workflows. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a trust-boundary failure in which the application expanded and resolved caller-supplied workspace paths via Python's Path(path).expanduser().resolve() but applied no containment check against the application's intended workspace root. This affected four POST endpoints: /api/session/new, /api/session/update, /api/chat/start, and /api/workspaces/add. The fix, introduced in api/workspace.py as resolve_trusted_workspace(), resolves the candidate path and enforces candidate.relative_to(_BOOT_DEFAULT_WORKSPACE) containment, returning HTTP 400 for any path outside the boot-time workspace root. The BOOT_DEFAULT_WORKSPACE anchor respects the HERMES_WEBUI_DEFAULT_WORKSPACE environment variable, ensuring consistency between the application's workspace root and what new_session() seeds as the initial workspace.

RemediationAI

Upgrade to hermes-webui v0.50.34, available at the GitHub release tag https://github.com/nesquena/hermes-webui/releases/tag/v0.50.34 and as commit 2a7a5ddfaf39e3b0094b7ac37e9f1dbcf40a3918 (https://github.com/nesquena/hermes-webui/commit/2a7a5ddfaf39e3b0094b7ac37e9f1dbcf40a3918). This release introduces resolve_trusted_workspace() in api/workspace.py and applies it to all four vulnerable endpoints, rejecting out-of-root paths with HTTP 400. As a compensating control before patching, run the hermes-webui process under a dedicated OS user account with read/write permissions restricted to only the intended workspace directory tree, which limits the files an attacker can reach via workspace redirection without eliminating the vulnerability itself - a trade-off between operational ease and exposure reduction. Additionally, restrict network access to the hermes-webui API to trusted authenticated users only, reducing the pool of potential attackers.