This vulnerability is a directory traversal flaw discovered in Hermes Studio version 0.6.26. The flaw resides in the validatePath function of the api/hermes/download endpoint, which fails to properly sanitize user-supplied path components. As a result, a remote attacker can craft a request that instructs the server to read files located outside the intended directory tree. The exposed files may contain configuration data, credentials, or other sensitive information, leading to potential compromise of the underlying system.

Hermes Studio version 0.6.26 is affected; no vendor information is supplied by the CNA data.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no publicly known exploit has been reported to date. Based on the description, the attack vector is inferred to be remote over HTTP, and it likely does not require authentication. The potential impact is significant because arbitrary file disclosure can expose credentials and configuration secrets. While CVSS metrics are not provided, the nature of the flaw suggests a high severity risk in the absence of mitigations.