Executive brief
Hermes Studio is a web-based development environment used for building and managing applications. A flaw in its file download feature allows authenticated users to read arbitrary files from the server's filesystem, potentially exposing sensitive data such as configuration files, database credentials, SSH keys, and application source code.
Technical details
The vulnerability is a path traversal (CWE-22) vulnerability in the /api/hermes/download endpoint of Hermes Studio. The validatePath() function only checks for ".." traversal sequences but does not restrict absolute paths to a sandbox directory, allowing any authenticated (non-admin) user to construct requests with absolute paths to read arbitrary files. The attack requires valid user credentials but does not require administrator privileges. The vulnerability allows disclosure of sensitive files including system configuration, environment variables containing API keys, SSH keys, and source code, leading to information exposure (CWE-200).
Affected products
- Hermes Studio Hermes Studio 0.6.26
Timeline
- 2026-08-17: disclosed