{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/h2ogpt/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-65700"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["h2oGPT 0.2.1"],"_cs_severities":["critical"],"_cs_tags":["path-traversal","rce","api-vulnerability","web-vulnerability","critical-vulnerability"],"_cs_type":"advisory","_cs_vendors":["h2oGPT"],"content_html":"\u003cp\u003eCVE-2026-65700 describes a critical path traversal vulnerability affecting h2oGPT through version 0.2.1. This flaw resides within the OpenAI-compatible files API, specifically in the \u003ccode\u003eget_user_dir\u003c/code\u003e function located in \u003ccode\u003eopenai_server/backend_utils.py\u003c/code\u003e. Attackers can exploit this by supplying path traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e or \u003ccode\u003e..\\\u003c/code\u003e) directly within the bearer token of an HTTP request. Since h2oGPT uses an \u0026quot;EMPTY\u0026quot; default API key, authentication is effectively bypassed, making the vulnerability accessible to unauthenticated remote attackers. Successful exploitation allows for arbitrary file read, write, and deletion, which can be leveraged to write to startup hooks or application-loaded files, thereby achieving remote code execution (RCE) on the underlying server. This poses a significant risk to organizations deploying affected h2oGPT instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker sends an HTTP POST request to a vulnerable h2oGPT OpenAI-compatible files API endpoint, such as \u003ccode\u003e/files/upload\u003c/code\u003e, \u003ccode\u003e/files/content\u003c/code\u003e, or \u003ccode\u003e/files/delete\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts the HTTP Authorization header to include a bearer token containing path traversal sequences (e.g., \u003ccode\u003eBearer ../../../path/to/malicious_file.sh\u003c/code\u003e) to manipulate the file path.\u003c/li\u003e\n\u003cli\u003eDue to the default \u0026quot;EMPTY\u0026quot; API key, the h2oGPT server bypasses authentication checks and proceeds to process the request as if it were legitimate.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eget_user_dir\u003c/code\u003e function in \u003ccode\u003eopenai_server/backend_utils.py\u003c/code\u003e is invoked, and it incorrectly incorporates the unsanitized bearer token string into a file path using \u003ccode\u003eos.path.join\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThis misconfiguration allows the attacker to specify an arbitrary file path outside the intended user directory, leading to the ability to read, write, or delete files anywhere on the server where the h2oGPT process has write permissions.\u003c/li\u003e\n\u003cli\u003eThe attacker uploads or modifies a malicious file (e.g., a web shell, a configuration file with injected commands, or a startup script) to a critical system location.\u003c/li\u003e\n\u003cli\u003eUpon the h2oGPT application restarting, reloading components, or when the tampered file is otherwise executed or loaded, the attacker's injected code achieves remote code execution (RCE) on the server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65700 grants unauthenticated remote attackers arbitrary file read, write, and delete capabilities on the compromised h2oGPT server. This directly leads to remote code execution (RCE) by allowing attackers to inject malicious code into application-loaded files or startup hooks. The consequences include complete compromise of the affected server, potential exfiltration of sensitive data, establishment of persistent backdoors, and lateral movement within the victim's network. Given the unauthenticated nature and the high CVSS score of 9.8, the vulnerability poses a critical threat to the confidentiality, integrity, and availability of systems running vulnerable h2oGPT versions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65700 immediately by upgrading h2oGPT to a version beyond 0.2.1 to mitigate this critical vulnerability.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect CVE-2026-65700 Exploitation Attempt - Path Traversal in Bearer Token\u003c/code\u003e to your web server logging infrastructure (e.g., Apache, Nginx access logs).\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for HTTP POST requests to OpenAI-compatible API endpoints that contain path traversal sequences (\u003ccode\u003e../\u003c/code\u003e, \u003ccode\u003e..\\\u003c/code\u003e) within the \u003ccode\u003ecs-auth-token\u003c/code\u003e field or HTTP Authorization header.\u003c/li\u003e\n\u003cli\u003eEnsure that all API keys, including default configurations, are replaced with strong, unique, and non-guessable credentials, and that API key authentication is properly enforced.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T18:28:55Z","date_published":"2026-07-23T18:28:55Z","id":"https://feed.craftedsignal.io/briefs/2026-07-h2ogpt-path-traversal-rce/","summary":"h2oGPT through version 0.2.1 contains a critical path traversal vulnerability (CVE-2026-65700) in its OpenAI-compatible files API, allowing unauthenticated remote attackers to achieve arbitrary file read, write, and delete, and ultimately remote code execution, by injecting traversal sequences into the bearer token.","title":"h2oGPT Path Traversal Vulnerability Leads to Remote Code Execution (CVE-2026-65700)","url":"https://feed.craftedsignal.io/briefs/2026-07-h2ogpt-path-traversal-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - H2oGPT","version":"https://jsonfeed.org/version/1.1"}