CVE-2026-49958
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Hermes WebUI before version 0.51.303 contains a TOCTOU vulnerability in the git_discard function that allows attackers to delete files outside the configured workspace boundary. This is possible by replacing a validated path component with a symlink after validation but before deletion.
Risk Assessment
This vulnerability may lead to unauthorized file deletions, posing a serious threat to data integrity within the organization.
Recommendation
It is recommended to update Hermes WebUI to version 0.51.303 or later to mitigate this vulnerability and review file operation security.
Original NVD description (English source)
Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git_discard function within api/workspace_git.py that allows attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink after validation but before deletion. Attackers can substitute a workspace-controlled path component with a symlink pointing to an external directory between the safe_resolve_ws() validation step and the subsequent Path.unlink() or shutil.rmtree() deletion call, causing the delete operation to follow the symlink and remove arbitrary files outside the workspace.