CVE-2026-65700 is a path traversal vulnerability in h2oGPT (<=0.2.1) affecting the OpenAI-compatible files API. The get_user_dir function in openai_server/backend_utils.py uses the bearer token directly in os.path.join without sanitization. Since the default API key is empty, authentication is bypassed, enabling unauthenticated attackers to supply traversal sequences in the bearer token to access files outside the intended directory. This allows reading, writing, and deleting arbitrary files accessible to the server process. Attackers can achieve remote code execution by writing to startup hooks or files loaded by the application.

The vulnerability permits unauthenticated remote attackers to perform arbitrary file read, write, and deletion on the server hosting h2oGPT. This can lead to remote code execution by placing malicious files in startup or application-loaded locations. The CVSS 4.0 base score is 9.3 (critical), reflecting the network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints and avoid deploying vulnerable versions in untrusted environments. Monitor vendor channels for updates and apply patches promptly once released.