Hermes WebUI before version 0.51.303 includes a time‑of‑check time‑of‑use race condition in the git_discard API function. The flaw is categorized under CWE‑367 and allows an attacker to delete files that are outside the intended workspace directory by replacing a validated path component with a symlink after the safe resolution step but before the unlink or remove operations. As a result, critical configuration or system files could be removed, leading to data loss, system instability, or further privilege escalation if the application runs with elevated privileges.

The vulnerability affects Hermes WebUI installations by the vendor nesquena, specifically any release earlier than version 0.51.303. There is no indication that later releases contain the flaw.

With a CVSS score of 4.3 the vulnerability is considered medium severity, and the EPSS score is not available. It is not listed in the CISA known exploited vulnerabilities catalog. The exploitation requires remote or local interaction with the git_discard API and the ability to create or modify symlinked paths within the configured workspace; the attack vector is likely remote via the web interface. If the application runs with privileged system accounts, deleting arbitrary files could result in system compromise. The lack of an EPSS score suggests a lower probability of widespread exploitation, but the potential impact warrants remediation.