A path traversal flaw exists in the OpenAI-compatible Files API of h2oGPT through version 0.2.1. The API allows an attacker to supply traversal sequences in the bearer token, which the backend treats as an unsanitized path component. This enables the attacker to read, write, or delete any file that the server process can access. By writing to files that are loaded at startup or read by the application, an adversary can execute arbitrary code on the host system. The weakness is a classic unauthorized path traversal (CWE-22).

Any deployment of h2oGPT version 0.2.1 or earlier from the h2oai:h2ogpt vendor. No narrower version subgroup is listed. No official patch version is currently cited in the advisory, so all susceptible releases remain vulnerable until a fix is released.

The CVSS score of 9.3 marks this as a critical issue, and the EPSS score of 1% indicates some, although comparatively low, probability of exploitation. The vulnerability is not listed in KeV and can be exploited over the network without authentication, because the default API key is empty, providing a complete bypass. Successful exploitation can lead to full remote code execution on the host system via the described write and read primitives.