CVE-2026-65700

Name of the Vulnerable Software and Affected Versions h2oGPT versions prior to 0.2.2

Description A path traversal issue exists in the OpenAI-compatible files API. Unauthenticated remote attackers can read, write, and delete arbitrary files accessible to the server process by providing traversal sequences within the bearer token. This occurs because the get user dir() function in openai server/backend utils.py uses the bearer token string as a path component via os.path.join without proper sanitization. Since the default API key is empty, authentication is bypassed. Attackers can use the file content, delete, and upload endpoints to move outside the intended user directory, potentially leading to remote code execution by writing to application-loaded files or startup hooks.

Recommendations Update h2oGPT to version 0.2.2 or later.