Which versions of h2oGPT are affected by CVE-2026-65700?

h2oGPT versions through 0.2.1 contain an unauthenticated remote code execution vulnerability in the OpenAI-compatible files API that allows attackers to read, write, and delete arbitrary files and…

Is there a public PoC exploit available for CVE-2026-65700?

Yes, a public proof-of-concept exploit is available for CVE-2026-65700. Prioritise patching immediately. EPSS: 1.3%.

How to fix or mitigate CVE-2026-65700?

Within 24 hours, identify all systems running h2oGPT through version 0.2.1 and immediately disable the OpenAI-compatible files API endpoint if the application cannot be taken offline; isolate affected systems from production networks and untrusted access; preserve logs for forensic analysis. Within 7 days, implement network controls (WAF rules, firewall restrictions) to block unauthenticated access to the files API; enforce authentication at the application layer where possible; scan systems for unauthorized file modifications and persistence mechanisms indicating active exploitation. Within 30 days, monitor the h2oGPT project for security patches; evaluate migrating to alternative solutions if no patch is released; conduct post-incident analysis of any detected compromise.

h2oGPT CVE-2026-65700

Q: What is the CVSS score of CVE-2026-65700?

CVE-2026-65700 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.3%.

EUVD-2026-48332 CRITICAL

Path Traversal (CWE-22)

2026-07-23 VulnCheck

GHSA-ffpm-9hgc-84cg

RCE Path Traversal H2Ogpt H2Oai

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable files API with empty default key gives unauthenticated (PR:N), low-complexity access; unsanitized traversal grants arbitrary read/write/delete and RCE, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:46 vuln.today

CVE Published

Jul 23, 2026 - 17:02 cve.org

CRITICAL 9.3

DescriptionCVE.org

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.path.join, and because the default API key is EMPTY authentication is bypassed, enabling attackers to traverse outside the intended user directory through the file content, delete, and upload endpoints to achieve remote code execution by writing to startup hooks or application-loaded files.

AnalysisAI

Remote code execution in h2oGPT through 0.2.1 lets unauthenticated remote attackers read, write, and delete arbitrary files by injecting path traversal sequences into the HTTP bearer token of the OpenAI-compatible files API. Because the shipped default API key is empty, authentication is effectively bypassed and the token string is used directly as a filesystem path component, so an attacker can escape the user directory and plant startup hooks or application-loaded files to execute code. Publicly available exploit code exists (reported by VulnCheck); there is no public exploit identified in CISA KEV, and the CVSS 4.0 base score is 9.3 (Critical).

Technical ContextAI

h2oGPT is an open-source LLM stack that exposes an OpenAI-compatible REST API. The flaw is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory (path traversal): the get_user_dir function in openai_server/backend_utils.py concatenates the caller-supplied bearer token into a filesystem path via os.path.join without sanitization. os.path.join is dangerous here because an absolute or '../'-laden component silently discards the intended base directory or walks above it. The token normally acts as a per-user namespace key, but it is fully attacker-controlled and, combined with an empty default API key, is never validated. The vulnerable surface spans the files content (read), delete, and upload (write) endpoints, giving full read/write/delete over any path the server process can access.

RemediationAI

No vendor-released patch version is identified in the provided data, so upgrade to a fixed release once the h2oGPT maintainers publish one; monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/h2ogpt-path-traversal-via-openai-compatible-files-api) for the fixed version. As the most impactful compensating control, set a strong non-empty API key so the empty-default authentication bypass is closed, which stops unauthenticated callers but does not by itself sanitize traversal for authenticated ones. Additionally, restrict network exposure of the OpenAI-compatible files API by binding it to localhost or placing it behind an authenticating reverse proxy or VPN, and run the server process as a low-privilege user in a container with a read-only filesystem for code and startup-hook directories so a successful write cannot achieve persistence or RCE - the trade-off is that legitimate file-upload workflows must be re-permissioned. Where the files API is not needed, disable it entirely. Reference the public analysis at https://github.com/geo-chen/oss/blob/main/h2ogpt.md when validating mitigations.