CVE-2026-6832 is an arbitrary file deletion vulnerability in Hermes WebUI's /api/session/delete endpoint. Authenticated attackers can exploit unvalidated session identifiers to delete files outside the intended session directory. The vulnerability allows path traversal attacks using absolute paths or directory traversal payloads in the session_id parameter. Attackers can bypass SESSION_DIR boundaries and delete writable JSON files on the host system. Multiple GitHub commits and releases address this security issue.