Dashboard / CVE-2026-49958

CVE-2026-49958

MEDIUM
MEDIUM Priority: 0.00 BB Relevance: 24/100
Published: 2026-06-09 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Low Complexity

CVSS Vector Breakdown

AV: Local
AC: High
PR: Low
UI: Active
AT: None
VC: None
VI: Low
VA: High

Description

Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git_discard function within api/workspace_git.py that allows attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink after validation but before deletion. Attackers can substitute a workspace-controlled path component with a symlink pointing to an external directory between the safe_resolve_ws() validation step and the subsequent Path.unlink() or shutil.rmtree() deletion call, causing the delete operation to follow the symlink and remove arbitrary files outside the workspace.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
nesquena hermes-webui 0 < 0.51.303

References & Advisories (5)

Bug Bounty Relevance

24 / 100
✓ Low complexity

CVSS Score

4.3 / 10.0 v4.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.08%
Raw Score 0.000810
Percentile 0.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00081
2026-11-12
0.00081
2026-11-10
0.00081
2026-11-09
0.00081
2026-11-08
0.00081

Intelligence Sources

mitre ref →

External Links