# CVE-2026-6832: nesquena Hermes WebUI arbitrary file deletion in session API

Source: https://junglewise.ai/threats/cve-2026-6832-nesquena-hermes-webui-arbitrary-file-deletion-in-session-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-6832 · Severity: high · CVSS 8.1 · Published 2026-04-21

Hermes WebUI, a web interface for managing sessions, contains a security flaw that allows logged-in users to delete arbitrary files on the server. By sending a specially crafted request to the session deletion endpoint, an attacker can bypass intended restrictions and remove critical system or application files. This could lead to data loss, service disruption, or the corruption of application state.

Technologies: [Nesquena Hermes WebUI](https://junglewise.ai/threats/technologies/hermes-webui). Vendors: [Nesquena](https://junglewise.ai/threats/vendors/nesquena).

## Quick answers

**Is CVE-2026-6832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6832 being exploited in the wild.

**How severe is CVE-2026-6832?** High severity, with a CVSS score of 8.1, published 21 April 2026.

**Which products and versions are affected?** Nesquena Hermes WebUI versions up to (excluding) 0.50.32.

**Is there a fix for CVE-2026-6832?** A patch was published on 2026-04-14: Fix merged in pull request #412 and released in v0.50.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6832 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-6832?** Check whether you run Get-Hermes Hermes Web Ui or Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An arbitrary file deletion vulnerability exists in Hermes WebUI due to improper validation of the 'session_id' parameter in the '/api/session/delete' endpoint. The application uses the user-provided 'session_id' to construct a file path using 'SESSION_DIR / f"{sid}.json"'. Because the input is not sanitized, an authenticated attacker can provide an absolute path or path traversal sequences (e.g., '../') to escape the intended session directory. This allows the deletion of any writable .json file on the host system that the server process has permissions to modify. The issue is fixed in version 0.50.32 by implementing regex validation for session IDs and enforcing path containment checks.

## Affected products

- nesquena Hermes WebUI versions up to (excluding) 0.50.32

## Timeline

- 2026-04-14: patched: Fix merged in pull request #412 and released in v0.50.32
- 2026-04-21: disclosed: CVE published to NVD

## References

- [https://github.com/nesquena/hermes-webui/commit/3cc5839bf303fa6758bfdac538507407a2929655](https://github.com/nesquena/hermes-webui/commit/3cc5839bf303fa6758bfdac538507407a2929655)
- [https://github.com/nesquena/hermes-webui/pull/409](https://github.com/nesquena/hermes-webui/pull/409)
- [https://github.com/nesquena/hermes-webui/pull/412](https://github.com/nesquena/hermes-webui/pull/412)
- [https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132](https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132)
- [https://github.com/nesquena/hermes-webui/releases/tag/v0.50.32](https://github.com/nesquena/hermes-webui/releases/tag/v0.50.32)
- [https://www.vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-file-deletion-via-unvalidated-session-id](https://www.vulncheck.com/advisories/nesquena-hermes-webui-arbitrary-file-deletion-via-unvalidated-session-id)

## Related threats

- [nesquena Hermes WebUI unauthenticated RCE in terminal API](https://junglewise.ai/threats/cve-2026-58123-nesquena-hermes-webui-unauthenticated-rce-in-terminal-api)
- [nesquena Hermes WebUI authorization bypass in session import](https://junglewise.ai/threats/cve-2026-58174-nesquena-hermes-webui-authorization-bypass-in-session-import)
- [nesquena Hermes WebUI authorization bypass in session export endpoint](https://junglewise.ai/threats/cve-2026-55198-nesquena-hermes-webui-authorization-bypass-in-session-export)
- [Hermes WebUI broken access control in /api/session endpoint](https://junglewise.ai/threats/cve-2026-55197-hermes-webui-broken-access-control-in-api-session-endpoint)
- [nesquena Hermes WebUI TOCTOU race condition in git_discard](https://junglewise.ai/threats/cve-2026-49958-nesquena-hermes-webui-toctou-race-condition-in-git-discard)