CVE-2026-65700 Details

A path traversal vulnerability has been identified in h2oGPT versions through 0.2.1, specifically within the OpenAI-compatible files API. This vulnerability allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process. Exploitation is achieved by injecting traversal sequences into the bearer token, which is then used unsanitized as a path component. The default API key is EMPTY, bypassing authentication and enabling attackers to traverse outside the designated user directory. The vulnerability can be exploited through the file content, delete, and upload endpoints, potentially leading to remote code execution by writing to startup hooks or application-loaded files.

Users are advised to reject bearer tokens that contain path traversal sequences and to ensure that the final file path is confined within the user's designated directory before performing any file operations. It is also recommended not to run the OpenAI server with authentication disabled on a non-loopback interface.