CVE-2026-22677

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-22677

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22677.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-22677

Published

2026-05-13T19:08:02.790Z

Modified

2026-07-15T01:48:57.578177418Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint

Details

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace field and subsequently use relative paths in the session file API to access any file readable by the WebUI process.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22677.json"
}

References

Affected packages

Git / github.com/nesquena/hermes-webui

Affected ranges

Type

GIT

Repo

https://github.com/nesquena/hermes-webui

Events

Introduced

Fixed

f00cb74f776f22f02f5eb6b39dfb389f87cc7fd3

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.51.44"
        }
    ]
}

Affected versions

v0.*

v0.12

v0.16

v0.16.1

v0.16.2

v0.17.1

v0.17.2

v0.17.3

v0.18

v0.18.1

v0.19

v0.20

v0.21

v0.22

v0.23

v0.24

v0.25

v0.26

v0.27

v0.28

v0.28.1

v0.29

v0.30

v0.30.1

v0.30.2

v0.30.3

v0.30.4

v0.31

v0.31.1

v0.31.2

v0.32

v0.33

v0.34

v0.34.1

v0.34.2

v0.34.3

v0.35

v0.35.1

v0.36

v0.36.1

v0.36.2

v0.36.3

v0.37.0

v0.38.0

v0.38.1

v0.38.2

v0.38.3

v0.38.4

v0.38.5

v0.38.6

v0.39.0

v0.39.1

v0.40.0

v0.40.1

v0.40.2

v0.41.0

v0.42.0

v0.42.1

v0.42.2

v0.43.0

v0.43.1

v0.44.0

v0.44.1

v0.45.0

v0.46.0

v0.47.0

v0.47.1

v0.48.0

v0.48.1

v0.48.2

v0.49.0

v0.49.1

v0.49.2

v0.49.3

v0.49.4

v0.50.0

v0.50.1

v0.50.10

v0.50.108

v0.50.109

v0.50.11

v0.50.110

v0.50.111

v0.50.112

v0.50.113

v0.50.114

v0.50.115

v0.50.116

v0.50.117

v0.50.118

v0.50.119

v0.50.12

v0.50.120

v0.50.121

v0.50.122

v0.50.123

v0.50.124

v0.50.125

v0.50.126

v0.50.127

v0.50.128

v0.50.129

v0.50.13

v0.50.130

v0.50.131

v0.50.132

v0.50.133

v0.50.134

v0.50.135

v0.50.136

v0.50.137

v0.50.138

v0.50.139

v0.50.14

v0.50.140

v0.50.141

v0.50.142

v0.50.143

v0.50.144

v0.50.145

v0.50.146

v0.50.147

v0.50.15

v0.50.150

v0.50.156

v0.50.157

v0.50.158

v0.50.159

v0.50.16

v0.50.160

v0.50.161

v0.50.162

v0.50.163

v0.50.164

v0.50.165

v0.50.166

v0.50.167

v0.50.168

v0.50.169

v0.50.17

v0.50.170

v0.50.171

v0.50.172

v0.50.173

v0.50.174

v0.50.175

v0.50.176

v0.50.177

v0.50.178

v0.50.179

v0.50.18

v0.50.180

v0.50.181

v0.50.182

v0.50.183

v0.50.184

v0.50.185

v0.50.186

v0.50.187

v0.50.188

v0.50.189

v0.50.19

v0.50.190

v0.50.191

v0.50.192

v0.50.193

v0.50.194

v0.50.195

v0.50.196

v0.50.197

v0.50.198

v0.50.199

v0.50.2

v0.50.20

v0.50.200

v0.50.202

v0.50.203

v0.50.204

v0.50.205

v0.50.206

v0.50.207

v0.50.208

v0.50.209

v0.50.21

v0.50.210

v0.50.211

v0.50.212

v0.50.214

v0.50.215

v0.50.216

v0.50.217

v0.50.218

v0.50.219

v0.50.22

v0.50.220

v0.50.221

v0.50.222

v0.50.223

v0.50.224

v0.50.225

v0.50.226

v0.50.227

v0.50.228

v0.50.229

v0.50.23

v0.50.230

v0.50.231

v0.50.232

v0.50.233

v0.50.235

v0.50.236

v0.50.237

v0.50.238

v0.50.239

v0.50.24

v0.50.240

v0.50.241

v0.50.242

v0.50.243

v0.50.244

v0.50.245

v0.50.246

v0.50.247

v0.50.248

v0.50.249

v0.50.25

v0.50.250

v0.50.251

v0.50.252

v0.50.253

v0.50.254

v0.50.255

v0.50.256

v0.50.257

v0.50.258

v0.50.259

v0.50.26

v0.50.260

v0.50.261

v0.50.262

v0.50.263

v0.50.264

v0.50.265

v0.50.266

v0.50.267

v0.50.268

v0.50.269

v0.50.27

v0.50.270

v0.50.271

v0.50.272

v0.50.273

v0.50.274

v0.50.275

v0.50.276

v0.50.277

v0.50.278

v0.50.279

v0.50.28

v0.50.280

v0.50.281

v0.50.282

v0.50.283

v0.50.284

v0.50.285

v0.50.286

v0.50.287

v0.50.288

v0.50.289

v0.50.29

v0.50.290

v0.50.291

v0.50.292

v0.50.293

v0.50.294

v0.50.295

v0.50.296

v0.50.297

v0.50.3

v0.50.30

v0.50.31

v0.50.32

v0.50.33

v0.50.34

v0.50.35

v0.50.36

v0.50.37

v0.50.38

v0.50.39

v0.50.4

v0.50.40

v0.50.41

v0.50.42

v0.50.43

v0.50.44

v0.50.45

v0.50.46

v0.50.47

v0.50.48

v0.50.49

v0.50.5

v0.50.50

v0.50.51

v0.50.52

v0.50.53

v0.50.54

v0.50.55

v0.50.56

v0.50.57

v0.50.58

v0.50.59

v0.50.6

v0.50.60

v0.50.61

v0.50.62

v0.50.63

v0.50.64

v0.50.67

v0.50.68

v0.50.69

v0.50.7

v0.50.70

v0.50.71

v0.50.72

v0.50.73

v0.50.74

v0.50.75

v0.50.76

v0.50.8

v0.50.82

v0.50.83

v0.50.84

v0.50.85

v0.50.86

v0.50.87

v0.50.88

v0.50.89

v0.50.9

v0.50.90

v0.50.91

v0.50.92

v0.50.93

v0.50.94

v0.50.95

v0.50.96

v0.51.0

v0.51.1

v0.51.10

v0.51.11

v0.51.12

v0.51.13

v0.51.14

v0.51.15

v0.51.16

v0.51.17

v0.51.18

v0.51.19

v0.51.2

v0.51.20

v0.51.21

v0.51.22

v0.51.23

v0.51.24

v0.51.25

v0.51.26

v0.51.27

v0.51.28

v0.51.29

v0.51.3

v0.51.30

v0.51.31

v0.51.32

v0.51.33

v0.51.34

v0.51.35

v0.51.36

v0.51.37

v0.51.38

v0.51.39

v0.51.4

v0.51.40

v0.51.41

v0.51.42

v0.51.43

v0.51.5

v0.51.6

v0.51.7

v0.51.8

v0.51.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22677.json"