CVE-2026-65700 in h2oGPT
Summary
by MITRE • 07/23/2026
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.path.join, and because the default API key is EMPTY authentication is bypassed, enabling attackers to traverse outside the intended user directory through the file content, delete, and upload endpoints to achieve remote code execution by writing to startup hooks or application-loaded files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability resides within h2oGPT version 0.2.1 and represents a critical path traversal flaw in the OpenAI-compatible files API implementation. The vulnerability stems from improper input validation within the get_user_dir function located in openai_server/backend_utils.py, where bearer token strings are directly utilized as path components without adequate sanitization or validation. This design flaw allows attackers to manipulate file system access through carefully crafted traversal sequences embedded within the bearer token parameter. The security risk is exacerbated by the fact that the default API key is set to EMPTY, which effectively bypasses authentication mechanisms and enables unauthenticated remote exploitation.
The technical implementation of this vulnerability leverages the os.path.join function to construct file paths using unsanitized bearer token inputs, creating a direct path traversal vector. Attackers can exploit this by crafting malicious bearer tokens containing directory traversal sequences such as '../' or similar patterns that allow them to navigate outside the intended user directory boundaries. The vulnerability affects multiple file operations including read, write, and delete functions within the file content, delete, and upload endpoints. This comprehensive access to file system operations creates a pathway for complete system compromise through remote code execution capabilities.
The operational impact of this vulnerability extends far beyond simple unauthorized file access, as it provides attackers with the ability to manipulate application behavior at runtime. By writing malicious payloads to startup hooks or application-loaded files, attackers can achieve persistent code execution within the server process context. This represents a severe escalation from initial exploitation to full system compromise, as the attacker gains control over application initialization sequences and loaded components. The vulnerability affects any environment where h2oGPT is deployed with default configurations, making it particularly dangerous in production environments.
Security mitigations for this vulnerability should focus on implementing proper input validation and sanitization of bearer token parameters before they are used in file path construction operations. The implementation must enforce strict path validation to prevent directory traversal sequences from being processed as legitimate path components. Organizations should immediately disable or restrict access to the OpenAI-compatible API endpoints until patches are applied, and implement authentication requirements that cannot be bypassed through default configurations. This vulnerability aligns with CWE-22 Path Traversal and represents a significant risk under ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries execute code through manipulated application interfaces.
The root cause analysis reveals fundamental security design flaws in the application's file system access controls and authentication bypass mechanisms. The combination of unsanitized input processing with weak default security configurations creates an exploitable condition that requires immediate remediation. Organizations should implement comprehensive logging of file system operations to detect potential exploitation attempts, while also enforcing strict access controls that prevent unauthorized users from performing file system manipulations through the API interface. This vulnerability demonstrates the critical importance of proper input validation and secure coding practices in preventing privilege escalation scenarios within web applications.