CVE-2026-67918

HighCVSS 7.5

Published: 17/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint.

Risk Assessment

An attacker could access files outside the application directory, potentially leading to disclosure of sensitive data such as configurations, passwords, or user data.

Recommendation

It is recommended to update hermes-studio to the latest version that includes security fixes and implement path validation for file access.

Original NVD description (English source)

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint