Critical Path Traversal Found in h2oGPT

A critical vulnerability identified as CVE-2026-65700 affects h2oGPT versions up to 0.2.1. The flaw resides in the OpenAI-compatible files API and permits unauthenticated remote attackers to manipulate file paths, leading to unauthorized read, write, and delete operations on the server.

This vulnerability is particularly dangerous because the system uses an empty default API key, effectively bypassing authentication mechanisms. By injecting traversal sequences into a bearer token, an attacker can escape the designated user directory to access sensitive system files or overwrite application components.

What's at Risk

The vulnerability affects all deployments of h2oGPT through version 0.2.1. Organizations that have deployed this software in internet-facing environments are at the highest risk, as the absence of authentication requirements allows any remote actor to interact with the API.

Because the vulnerability allows for file writes, an attacker could potentially achieve remote code execution by targeting startup hooks or other application-loaded files. This could result in a complete compromise of the server hosting the h2oGPT instance, allowing the attacker to control the application environment or pivot further into the underlying infrastructure.

How the Flaw Works

Path traversal is a class of vulnerability that occurs when an application uses user-supplied input to construct a file path without sufficient validation. In general, this allows an attacker to use special characters, such as dot-dot-slash sequences, to navigate outside of the intended directory structure.

When an application fails to sanitize these inputs, it may inadvertently grant the attacker access to files that are stored elsewhere on the host filesystem. If the application process runs with elevated privileges, the attacker may be able to read sensitive configuration files, overwrite critical system binaries, or upload malicious scripts that the server later executes. This type of weakness is a common target for automated exploitation tools that scan for improperly secured API endpoints.

How to Protect Your Systems

• Review the official project guidance for any available patches or configuration changes to address CVE-2026-65700.
• Ensure that any deployment of h2oGPT is restricted to trusted internal networks rather than being exposed directly to the public internet.
• Implement strong, non-default authentication mechanisms for all API endpoints to prevent unauthorized access.
• Monitor server logs for suspicious API requests containing directory traversal sequences or unexpected file modification attempts.
• Apply the principle of least privilege by running the application process under a dedicated user account with limited filesystem permissions.

Given the 9.8 CVSS score and the potential for remote code execution, this vulnerability represents a significant security risk. Organizations should prioritize verifying their version of h2oGPT and applying all available security updates immediately to prevent unauthorized access to their systems.