CVE-2026-49957

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.296

Description An authenticated attacker can bypass workspace boundary checks by exploiting an early return in the SSH/remote terminal profile workspace resolution logic within the remote terminal workspace candidate() function. By configuring a remote terminal working directory to a system directory, such as /etc, the workspace resolution path accepts it as a trusted local workspace root before the is blocked workspace path() guard executes. This allows unauthorized read access to local system files through workspace file-read helpers.

Recommendations Update to version 0.51.296 or later.