CVE-2026-11322

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.221

Description A path traversal issue allows attackers to escape the workspace boundary by providing symlinks that resolve to files or directories outside the designated workspace root. By exploiting the workspace file and listing APIs, which resolve symlink targets without verifying that the final path remains within the workspace, an attacker can read external host files accessible to the server process. This can lead to the disclosure of sensitive data, including SSH keys, cloud credentials, or application tokens.

Recommendations Update to version 0.51.221 or later.