Executive brief
A security vulnerability exists in the adenhq hive framework, a Python-based tool for managing sessions and data. An unauthenticated remote attacker can exploit this flaw to delete arbitrary folders on the server's filesystem. This could lead to significant data loss, system instability, or a complete shutdown of the service by destroying critical application files.
Technical details
A path traversal vulnerability (CWE-22) exists in the 'handle_delete_history_session' function within 'core/framework/server/routes_sessions.py'. The application fails to sanitize the 'session_id' parameter received via the 'DELETE /api/sessions/history/{session_id}' endpoint. Because the 'aiohttp' framework automatically decodes URL-encoded path segments, an attacker can provide sequences like '%2E%2E%2F' (../) to escape the intended directory. The resolved path is then passed directly to 'shutil.rmtree()', allowing for the recursive deletion of any directory the application process has permissions to access. No authentication is required to trigger this vulnerability.
Affected products
- adenhq hive up to 0.11.0
Timeline
- 2026-03-21: disclosed: Initial discovery and PoC shared via GitHub Gist.
- 2026-05-17: advisory: CVE-2026-8757 published.