CVE-2026-65700
Deferred Deferred - Pending Action

Path Traversal in h2oGPT via OpenAI-Compatible Files API

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.path.join, and because the default API key is EMPTY authentication is bypassed, enabling attackers to traverse outside the intended user directory through the file content, delete, and upload endpoints to achieve remote code execution by writing to startup hooks or application-loaded files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65700
EUVD
EUVD-2026-48332

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openai h2ogpt 0.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65700 is a path traversal vulnerability in h2oGPT's OpenAI-compatible server affecting version 0.2.1. The issue occurs because the server uses the unsanitized bearer token from the Authorization header as a path component to determine the user's storage directory. When the server runs with the default empty API key, authentication is disabled, allowing attackers to manipulate the bearer token with path traversal sequences like ../ to read, delete, or write arbitrary files on the host system.

Detection Guidance

Check if h2oGPT version 0.2.1 or earlier is running without a configured API key. Inspect network traffic for requests to OpenAI-compatible endpoints with unusual bearer tokens containing path traversal sequences like ../. Review server logs for unauthorized file access attempts or suspicious file operations.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to read sensitive files, delete critical files, or upload malicious files to the server. Attackers could access files outside the intended directory like /etc/passwd, delete important system files, or upload files that lead to remote code execution by targeting startup hooks or application-loaded files.

Compliance Impact

This vulnerability can severely impact compliance with standards like GDPR and HIPAA by enabling unauthorized access to sensitive files. Attackers could read, modify, or delete files containing personal data, protected health information, or other confidential data, leading to violations of data protection requirements and potential legal penalties.

Mitigation Strategies

Immediately configure a strong API key for h2oGPT to enforce authentication. Update to the latest version if available. Implement input validation to sanitize bearer tokens before path construction. Restrict file system permissions to limit access to sensitive directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart