Skip to content
Threat Feed
Subscribe

Vendor

H2oGPT

1 brief RSS
critical advisory

h2oGPT Path Traversal Vulnerability Leads to Remote Code Execution (CVE-2026-65700)

h2oGPT through version 0.2.1 contains a critical path traversal vulnerability (CVE-2026-65700) in its OpenAI-compatible files API, allowing unauthenticated remote attackers to achieve arbitrary file read, write, and delete, and ultimately remote code execution, by injecting traversal sequences into the bearer token.

h2oGPT 0.2.1 path-traversal rce api-vulnerability web-vulnerability critical-vulnerability
1r 3t 1c