CVE-2026-49957: Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py

Vulnerability summary

CVE-2026-49957 is a high (CVSS 7.7) Path Traversal vulnerability in nesquena hermes-webui. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.2% of scored vulnerabilities.

Timeline

1. 09-06-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows authenticated attackers to circumvent blocked-root path checks by exploiting an early return in the SSH/remote terminal profile workspace resolution logic within _remote_terminal_workspace_candidate(). Attackers can configure a remote terminal working directory to a system directory such as /etc, causing the workspace resolution path to accept it as a trusted local workspace root before the _is_blocked_workspace_path() guard executes, enabling read access to local system files through workspace file-read helpers.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.