An unauthenticated path traversal vulnerability in h2oGPT allows remote attackers to gain full system control by manipulating file paths via the bearer token.

This is a path traversal vulnerability (CWE-22) originating from the unsafe handling of bearer tokens in the get_user_dir function. Because the default API key is empty, the system fails to enforce authentication, permitting an unauthenticated attacker to traverse directories and potentially achieve remote code execution by overwriting startup hooks.

The ability to read, write, and delete arbitrary files on the server constitutes a total compromise of the application environment. With a CVSS score of 9.8, this vulnerability allows for complete data exfiltration and persistent backdooring of the server process.

Immediate Action: Update h2oGPT to the latest version that addresses the path traversal flaw in the OpenAI-compatible files API.

Proactive Monitoring: Monitor server file system logs for unauthorized access or modification attempts outside of designated user directories.

Compensating Controls: Ensure that the h2oGPT instance is not exposed to the public internet and restrict access to the API via network-level controls or a reverse proxy requiring secondary authentication.

Public Exploit Available: Unknown.

This is a critical flaw that enables unauthenticated remote code execution. Immediate patching is required, and organizations should audit their h2oGPT deployments to ensure they are not exposed to untrusted network segments until the update is applied.