h2oGPT OpenAI-Compatible API Path Traversal to Remote Code Execution

Technical Analysis

The vulnerability resides in the get_user_dir function in openai_server/backend_utils.py, which passes the bearer token directly into os.path.join without sanitization, allowing '../' traversal sequences to escape the intended per-user directory sandbox. Combined with the default EMPTY API key, this effectively removes authentication controls on the file content, upload, and delete endpoints, giving unauthenticated remote attackers full arbitrary file read/write/delete capability. Attackers can leverage the write primitive to overwrite startup hooks, configuration files, or Python modules loaded at application boot, achieving remote code execution on the host. This CVE (CVE-2026-65700, CVSS 9.8) directly targets an LLM serving stack: h2oGPT is frequently deployed as a self-hosted inference backend and OpenAI-compatible endpoint for RAG pipelines and agent frameworks, so exploitation could lead to theft of API keys, poisoning of RAG document stores, tampering with model configs, or full compromise of hosts running downstream AI agents.

Affected Systems

h2oGPT versions through 0.2.1, specifically the OpenAI-compatible files API (openai_server/backend_utils.py, get_user_dir function); deployments using the default EMPTY API key configuration are most exposed.

Indicators of Compromise

• No specific hashes/IPs published; watch for anomalous bearer tokens containing '../' or '..\\' traversal sequences in requests to /v1/files, file content, upload, and delete endpoints; unexpected file writes outside configured user directories; modified startup hook scripts or unexpected new Python files in h2oGPT application directories.

Remediation Steps

1. 1

   Upgrade h2oGPT

   Update to a patched version of h2oGPT beyond 0.2.1 once available from the vendor; monitor project advisories for the official fix.

2. 2

   Enforce strong API key authentication

   Explicitly configure a strong, non-empty API key for the OpenAI-compatible endpoint and never rely on the default EMPTY value.

3. 3

   Sanitize and validate input paths

   If self-patching, add strict validation to reject any bearer token or path parameter containing traversal sequences ('../', encoded variants) before use in os.path.join.

4. 4

   Restrict network exposure

   Place h2oGPT deployments behind a reverse proxy or firewall, restricting access to the files API to trusted internal networks or authenticated gateways only.

5. 5

   Audit and isolate file system access

   Run h2oGPT under a least-privilege service account with restricted filesystem permissions, and use containerization/chroot to limit blast radius of any successful traversal.

6. 6

   Rotate exposed credentials

   If exposed to the internet with default configuration, assume compromise; rotate all API keys, credentials, and secrets accessible to the h2oGPT host, including any used by connected AI agents or RAG pipelines.