h2oGPT <=0.2.1 Path Traversal Vulnerability: Early Warning
An early warning has been issued regarding a critical path traversal vulnerability in h2oGPT versions up to and including 0.2.1. This vulnerability, reportedly allowing unauthenticated remote attackers to read, write, and delete arbitrary files, could potentially lead to remote code execution.
What happened
According to the National Vulnerability Database (NVD), h2oGPT through version 0.2.1 contains a path traversal vulnerability in its OpenAI-compatible files API. This vulnerability appears to allow unauthenticated remote attackers to manipulate arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The issue reportedly arises from the get_user_dir function in openai_server/backend_utils.py, which uses the bearer token string unsanitized as a path component.
The vulnerability is under investigation, with initial reports suggesting that it could enable attackers to traverse outside the intended user directory through file content, delete, and upload endpoints. This could potentially lead to remote code execution by writing to startup hooks or application-loaded files. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
Professional software engineers using h2oGPT are advised to upgrade to a version beyond 0.2.1 as a precautionary measure. Additionally, reviewing server file access controls is recommended to mitigate potential risks. For the most accurate and up-to-date information, consult the primary sources listed.
How 0Day mitigates this
h2ogpt is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.