CVE-2026-14628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14628", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-03T17:07:53.319Z", "datePublished": "2026-07-04T13:00:08.104Z", "dateUpdated": "2026-07-06T16:25:15.490Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-04T13:00:08.104Z"}, "title": "NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "NousResearch", "product": "hermes-agent", "versions": [{"version": "2026.5.0", "status": "affected"}, {"version": "2026.5.1", "status": "affected"}, {"version": "2026.5.2", "status": "affected"}, {"version": "2026.5.3", "status": "affected"}, {"version": "2026.5.4", "status": "affected"}, {"version": "2026.5.5", "status": "affected"}, {"version": "2026.5.6", "status": "affected"}, {"version": "2026.5.7", "status": "affected"}, {"version": "2026.5.8", "status": "affected"}, {"version": "2026.5.9", "status": "affected"}, {"version": "2026.5.10", "status": "affected"}, {"version": "2026.5.11", "status": "affected"}, {"version": "2026.5.12", "status": "affected"}, {"version": "2026.5.13", "status": "affected"}, {"version": "2026.5.14", "status": "affected"}, {"version": "2026.5.15", "status": "affected"}, {"version": "2026.5.16", "status": "affected"}], "cpes": ["cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*"], "modules": ["Live Webhook Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of the file gateway/platforms/base.py of the component Live Webhook Endpoint. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-03T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-03T19:13:07.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-a (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/376144", "name": "VDB-376144 | NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/376144/cti", "name": "VDB-376144 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-14628", "name": "CVE-2026-14628 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/845599", "name": "Submit #845599 | NousResearch Hermes Agent <= v2026.5.16 Path Traversal / Improper Limitation of a Pathname to a Restricted Directory (CWE-22)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/8af7eff27b50bec24b2d0f76dd1c4383", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T16:25:04.744864Z", "id": "CVE-2026-14628", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T16:25:15.490Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-14628", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T16:25:04.744864Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T16:25:11.507Z"}}], "cna": {"title": "NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-a (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*"], "vendor": "NousResearch", "modules": ["Live Webhook Endpoint"], "product": "hermes-agent", "versions": [{"status": "affected", "version": "2026.5.0"}, {"status": "affected", "version": "2026.5.1"}, {"status": "affected", "version": "2026.5.2"}, {"status": "affected", "version": "2026.5.3"}, {"status": "affected", "version": "2026.5.4"}, {"status": "affected", "version": "2026.5.5"}, {"status": "affected", "version": "2026.5.6"}, {"status": "affected", "version": "2026.5.7"}, {"status": "affected", "version": "2026.5.8"}, {"status": "affected", "version": "2026.5.9"}, {"status": "affected", "version": "2026.5.10"}, {"status": "affected", "version": "2026.5.11"}, {"status": "affected", "version": "2026.5.12"}, {"status": "affected", "version": "2026.5.13"}, {"status": "affected", "version": "2026.5.14"}, {"status": "affected", "version": "2026.5.15"}, {"status": "affected", "version": "2026.5.16"}]}], "timeline": [{"lang": "en", "time": "2026-07-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-03T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-03T19:13:07.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/376144", "name": "VDB-376144 | NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/376144/cti", "name": "VDB-376144 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-14628", "name": "CVE-2026-14628 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/845599", "name": "Submit #845599 | NousResearch Hermes Agent <= v2026.5.16 Path Traversal / Improper Limitation of a Pathname to a Restricted Directory (CWE-22)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/8af7eff27b50bec24b2d0f76dd1c4383", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of the file gateway/platforms/base.py of the component Live Webhook Endpoint. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-04T13:00:08.104Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14628", "state": "PUBLISHED", "dateUpdated": "2026-07-06T16:25:15.490Z", "dateReserved": "2026-07-03T17:07:53.319Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-04T13:00:08.104Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*"], "modules": ["Live Webhook Endpoint"], "product": "hermes-agent", "vendor": "NousResearch", "versions": [{"status": "affected", "version": "2026.5.0"}, {"status": "affected", "version": "2026.5.1"}, {"status": "affected", "version": "2026.5.2"}, {"status": "affected", "version": "2026.5.3"}, {"status": "affected", "version": "2026.5.4"}, {"status": "affected", "version": "2026.5.5"}, {"status": "affected", "version": "2026.5.6"}, {"status": "affected", "version": "2026.5.7"}, {"status": "affected", "version": "2026.5.8"}, {"status": "affected", "version": "2026.5.9"}, {"status": "affected", "version": "2026.5.10"}, {"status": "affected", "version": "2026.5.11"}, {"status": "affected", "version": "2026.5.12"}, {"status": "affected", "version": "2026.5.13"}, {"status": "affected", "version": "2026.5.14"}, {"status": "affected", "version": "2026.5.15"}, {"status": "affected", "version": "2026.5.16"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of the file gateway/platforms/base.py of the component Live Webhook Endpoint. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en NousResearch hermes-agent hasta la versi\u00f3n 2026.5.16. Esto afecta a la funci\u00f3n extract_media del archivo gateway/platforms/base.py del componente Live Webhook Endpoint. Realizar una manipulaci\u00f3n resulta en un salto de ruta. El ataque puede iniciarse de forma remota. El exploit ahora es p\u00fablico y puede ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-14628", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14628", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T16:25:04.744864Z", "version": "2.0.3"}}]}, "published": "2026-07-04T13:16:30.413", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/YLChen-007/8af7eff27b50bec24b2d0f76dd1c4383"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-14628"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/845599"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/376144"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/376144/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2026.5.16"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "hermes-agent", "source": "cna", "vendor": "NousResearch"}, "product": "hermes-agent", "vendor": "nousresearch"}], "created": "2026-07-04T14:30:04.209046+00:00", "updated": "2026-08-01T19:45:03.784341+00:00", "vendors": ["nousresearch", "nousresearch$PRODUCT$hermes-agent"]}