Authenticated attackers can exploit a path traversal vulnerability in the Hermes WebUI /api/session/delete endpoint to perform unauthorized deletion of arbitrary files on the host system.

This is a path traversal vulnerability (CWE-22) located in the /api/session/delete endpoint. An authenticated attacker can manipulate the session_id parameter to escape the intended session directory and delete arbitrary writable files on the host filesystem.

The ability to delete arbitrary files on a host system poses a severe risk to system integrity and availability. An attacker could potentially delete critical configuration files, system binaries, or application data, leading to a complete denial of service or the destabilization of the host environment. With a CVSS score of 8.1, this vulnerability represents a high-severity threat that requires immediate attention to prevent malicious actors from sabotaging application infrastructure.

Immediate Action: Update the hermes-webui software to a version that includes the fix provided in PR #409 and associated commits (e.g., v0.50.132).

Proactive Monitoring: Review application access logs for suspicious requests to the /api/session/delete endpoint, specifically looking for path traversal sequences such as double dots (../) or absolute file paths in the session_id parameter.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and block incoming HTTP requests containing path traversal patterns in the session_id parameter.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for significant disruption to host system operations, organizations using Hermes WebUI must prioritize patching. Administrators should verify their current deployment version and apply the vendor-supplied updates immediately to remediate the path traversal vulnerability and prevent unauthorized file deletion.