Read the docs
TI-2026-69497 Aliases CVE-2026-103663GHSA-w8p2-phwr-px3r

Path traversal in Ollama leads to remote code execution

Priority MEDIUM 44CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Ollama from 0.34.2 before 0.35.0 is affected. The digestToPath function behind the /api/pull endpoint does not validate layer digests sufficiently, which enables path traversal (CWE-23). An unauthenticated remote attacker can use a traversal sequence as a layer digest to write a malicious binary outside the model store. If the server process can write to /usr/lib/ollama, as in most default Ollama Docker images, the file is loaded and executed as root on the next server restart.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store.  Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00714 53rd percentileScored 2026-11-07
Fix Fixed Ollama (Ollama): 0.35.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ollamaOllama0.34.2 to before 0.35.00.35.0Patch availableCNA
  • Ollama Vendorollama Affected 0.34.2 to before 0.35.0 Fixed in 0.35.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*——ollama
  • cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:* Versions — — ·ollama

Remediation

Ollama 0.35.0 fixes this issue. Update Ollama to version 0.35.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Ollama (Ollama) Fixed in 0.35.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Migration Toolkit for Applications 8
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-103663
  2. 2026-10-08 Alias added: GHSA-w8p2-phwr-px3r
  3. 2026-10-10 Affected versions changed · Red Hat
  4. 2026-10-10 CVSS score added · Red Hat

References

Advisory 1

Other 1

  • TI-2024-24572 Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex… CVSS 3.1HIGH 8.8
  • TI-2025-14153 Ollama Multi-Modal Model Image Processing NULL Pointer Dereference CVSS 4.0HIGH 8.7
  • TI-2024-26641 An issue was discovered in Ollama before 0.1.46. CVSS 3.1HIGH 8.2
  • TI-2025-41098 An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via… CVSS 3.1HIGH 7.5
  • TI-2025-41097 An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder CVSS 3.1HIGH 7.5
  • TI-2025-01720 Improper Validation of Array Index in ollama/ollama CVSS 3.0HIGH 7.5
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences