Executive brief
Hermes WebUI is a management interface used to interact with workspaces and files. A security flaw allows an attacker to use specially crafted symbolic links (symlinks) to bypass folder restrictions and access files anywhere on the host server. This could lead to the theft of sensitive information such as SSH keys, cloud credentials, and application tokens, potentially compromising the entire server infrastructure.
Technical details
A path traversal vulnerability exists in Hermes WebUI's workspace file and listing APIs due to improper link resolution (CWE-59). The 'safe_resolve_ws' function failed to verify that a resolved symlink target remained within the designated workspace root, relying instead on a limited system-directory denylist. An authenticated attacker can create or provide a workspace containing symlinks pointing to sensitive host locations (e.g., ~/.ssh). When these paths are accessed via the WebUI or LLM agent tool calls, the server discloses the contents of the external files. Additionally, a TOCTOU (Time-of-Check to Time-of-Use) race condition was identified where a symlink could be swapped after validation but before file access. The issue is fixed in v0.51.221 by implementing anchored file operations and strict path containment checks.
Affected products
- nesquena Hermes WebUI < v0.51.221
Timeline
- 2026-06-02: patched: Fix merged in pull request 3398
- 2026-06-04: advisory: NVD and VulnCheck published advisory details