Description

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T22:17:25.910Z",
  "pubdate": "2026-08-17T22:17:25.910Z",
  "executiveSummary": "A Directory Traversal vulnerability has been identified in hermes-studio v.0.6.26, specifically residing within the validatePath function exposed via the api/hermes/download endpoint. This security flaw allows a remote, unauthenticated attacker to bypass intended directory restrictions and traverse the underlying file system.\nBy manipulating input parameters supplied to the vulnerable download endpoint, an adversary can coerce the application into accessing and retrieving arbitrary files outside the intended web root or storage directory. The primary impact of this vulnerability is unauthorized information disclosure, potentially exposing sensitive system files, configuration data, application source code, or credentials.\nThe risk implication is high, as successful exploitation requires no special privileges or prior authentication, enabling remote attackers to harvest critical system intelligence directly over the network. Remediation requires proper input sanitization, strict path normalization, and canonicalization checks within the validatePath function to ensure requested resources resolve strictly within the designated safe base directory.",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and path sanitization within the validatePath function located in the api/hermes/download endpoint of hermes-studio v.0.6.26. When processing file retrieval requests, the application fails to adequately neutralize directory traversal sequences, such as dot-dot-slash (../) patterns, allowing malicious payloads to manipulate the absolute or relative file path resolution.\nThe attack vector is network-exposed, requiring remote access to the HTTP-based api/hermes/download endpoint. An attacker initiates the exploitation flow by crafting a specialized HTTP request containing malicious traversal sequences directed at the vulnerable parameter processed by validatePath. Because the underlying file retrieval logic improperly validates or canonicalizes the supplied path before performing read operations, the operating system resolves the path outside the intended confines of the application repository.\nUpon successful payload execution, the application reads the targeted sensitive file from the file system and returns its contents in the HTTP response body to the remote client. Post-exploitation impact is characterized by unauthorized data exfiltration, where the attacker gains visibility into critical operating system files or application-specific secrets, facilitating further compromise against the host infrastructure."
}