CVE-2026-6832 | nesquena hermes-webui up to 408 JSON File /api/session/delete session_id path traversal

A vulnerability was found in nesquena hermes-webui up to 408. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the file /api/session/delete of the component JSON File Handler. Performing a manipulation of the argument session_id results in path traversal.

This vulnerability was named CVE-2026-6832. The attack may be initiated remotely. There is no available exploit.

Upgrading the affected component is advised.