CVE-2026-11322
Last modified
CVE-2026-11322 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files accessible to the server process and disclose sensitive data such as SSH keys, cloud credentials, or application tokens.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve symlink targets without enforcing that the final path remains within the workspace, to read external host files accessible to the server process and disclose sensitive data such as SSH keys, cloud credentials, or application tokens.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-11322?
How severe is CVE-2026-11322?
How do I fix CVE-2026-11322?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11310X.509 trust-chain bypass in the OpenSSL compatibility certif…7.5
- CVE-2026-11311When NGINX Plus is configured as the data plane for NGINX Ga…6.5
- CVE-2026-11312A vulnerability was found in bytedance InfiniStore up to 0.2…3.3
- CVE-2026-11317A denial of service security issue exists in the affected pr…8.7
- CVE-2026-1132A vulnerability was found in Yonyou KSOA 9.0. The affected e…9.8
- CVE-2026-11321The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) co…7.1
- CVE-2026-11324The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay ga…6.1
- CVE-2026-11325Description Cloudflare was recently notified by external …8.8
- CVE-2026-11326OpenAI Atlas before 1.2025.288.15 exposed privileged browser…6
- CVE-2026-11328The Exclusive Addons for Elementor plugin for WordPress is v…6.4
- CVE-2026-11329A vulnerability has been found in onnx onnx-mlir up to 0.5.0…3.6
- CVE-2026-1133A vulnerability was determined in Yonyou KSOA 9.0. The impac…9.8
Are you affected by CVE-2026-11322?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST