CVE-2026-6832

CVE-2026-6832 is an arbitrary file deletion vulnerability in Hermes WebUI affecting the /api/session/delete endpoint. Authenticated attackers can exploit insufficient input validation on the session_id parameter to supply absolute paths or path traversal sequences, enabling deletion of JSON files outside the intended session directory and across the host system. This allows malicious authenticated users to destroy critical files with write permissions. The vulnerability carries a CVSS v3.1 score of 8.1 (HIGH) with a network-based attack vector, low complexity, and requirements for low privileges. While confidentiality is not impacted, the integrity and availability impacts are rated as HIGH, reflecting the ability to delete arbitrary writable files. The EPSS score of 0.0009 indicates this vulnerability is currently in the lower percentile for exploitation probability across the CVE ecosystem. Exploitation status shows no active real-world attacks documented. The vulnerability does not appear on the CISA KEV catalog and remains inactive on threat intelligence hot lists, suggesting minimal current threat actor interest. However, the straightforward nature of the exploitation method warrants prompt patching by organizations running vulnerable Hermes WebUI deployments.