CVE-2026-65700 is a path traversal vulnerability in h2oGPT (<=0.2.1) affecting the OpenAI-compatible files API. The vulnerability arises because the get_user_dir function uses the bearer token directly as a path component without sanitization, allowing traversal sequences. Since the default API key is empty, authentication is bypassed, enabling unauthenticated attackers to access, modify, or delete arbitrary files accessible to the server process. This can lead to remote code execution by writing malicious content to startup hooks or application-loaded files.

An unauthenticated remote attacker can read, write, and delete arbitrary files on the server running h2oGPT (<=0.2.1). This includes the ability to escape the intended user directory via path traversal. The attacker can achieve remote code execution by placing malicious code in startup hooks or files loaded by the application, potentially compromising the entire server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the vulnerable API, and consider disabling or restricting the OpenAI-compatible files API functionality. Monitor for updates from the vendor h2oai regarding an official fix or mitigation.