This vulnerability is a directory traversal flaw (CWE-22) discovered in Hermes Studio version 0.6.26. The flaw resides in the validatePath function of the api/hermes/download endpoint, which fails to properly sanitize user‑supplied path components. As a result, a remote attacker can craft a request that instructs the server to read files located outside the intended directory tree. The exposed files may contain configuration data, credentials, or other sensitive information, leading to potential compromise of the underlying system.

Hermes Studio version 0.6.26 is affected; no vendor information is supplied by the CNA data.

The CVSS score of 7.5 indicates high severity, with no publicly known exploit and a very low EPSS score of less than 1%, meaning the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over HTTP without authentication. A remote attacker can craft requests against the api/hermes/download endpoint and read files outside the intended directory, potentially exposing sensitive configuration or credential information.