A critical, unauthenticated path traversal flaw in h2oGPT through version 0.2.1 lets remote attackers read, write, and delete arbitrary files on the server and can be escalated to remote code execution.
What Is It
CVE-2026-65700 is a path traversal vulnerability (CWE-22) in h2oGPT's OpenAI-compatible files API. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string, unsanitized, as a path component via os.path.join. Because the default API key is EMPTY, authentication is bypassed. An attacker supplies traversal sequences inside the bearer token to break out of the intended user directory through the file content, delete, and upload endpoints. The vulnerability was assigned by [email protected] and is tagged "unsupported-when-assigned."
Why It Matters
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a CVSS 4.0 secondary score of 9.3. It is network-reachable, low-complexity, and requires no privileges or user interaction. Because attackers can write to startup hooks or application-loaded files, arbitrary file write escalates to remote code execution, giving full confidentiality, integrity, and availability impact over any file accessible to the server process.
What's Vulnerable
- Vendor/product: h2oai; h2oGPT
- Affected versions: all versions up through and including 0.2.1 (default status: affected)
- Repository: https://github.com/h2oai/h2ogpt
Deployments running with the default EMPTY API key are exposed to unauthenticated exploitation.
Patch Status
The NVD record lists a vulnerability status of "Deferred" and carries the "unsupported-when-assigned" tag, indicating the affected software was unsupported when the CVE was assigned. No fixed version is specified in the supplied source material, and the CISA KEV data provided contains no entry for this CVE, there is no confirmation of active exploitation and no KEV-mandated required action in the supplied sources. Operators should restrict network exposure of the h2oGPT files API and set a non-empty API key where feasible.
Sources
- NVD, CVE-2026-65700 (via [email protected])
- VulnCheck advisory; https://www.vulncheck.com/advisories/h2ogpt-path-traversal-via-openai-compatible-files-api
- Researcher disclosure (geo-chen/oss), https://github.com/geo-chen/oss/blob/main/h2ogpt.md