Hermes WebUI versions older than 0.51.44 contain a path traversal vulnerability in the session import endpoint that permits authenticated users to import a crafted session with an unrestricted workspace value. By supplying a blocked filesystem root in the workspace field, an attacker can then use relative paths in the session file API to access any file readable by the WebUI process, resulting in arbitrary file read. The flaw is an input validation failure identified as CWE‑22, compromising confidentiality of data accessible by the WebUI process.

The affected product is Hermes WebUI from the vendor Nesquena. All releases with a version number lower than 0.51.44 are impacted. Users running those earlier builds should verify if any interim releases include a fix and rationally assess whether the configuration permits authenticated session import.

The CVSS score of 6 indicates medium severity, and the EPSS score of less than 1% reflects a very low probability of exploitation at the time of this analysis. The vulnerability requires authentication to the WebUI, so it is not exploitable by unauthenticated users. It is not listed in the CISA KEV catalog. The attack vector is inferred to be authenticated, as the description requires a logged‑in session to import a crafted session. Given the authentication requirement, the risk is primarily to confidential data readable by the WebUI process rather than full system compromise. The lack of remote code execution limits overall impact, but arbitrary file read remains a serious concern for protected information.