Ollama: Path traversal leading to remote code execution
Summary
Ollama versions 0.34.2 up to, but not including, 0.35.0 contain a path traversal flaw in the /api/pull endpoint. An unauthenticated remote attacker can send a crafted layer digest to write a malicious file outside the model store. If the server process can write to /usr/lib/ollama, which is the default in most Ollama Docker images, the file is loaded and executed as root on the next server restart, which leads to remote code execution.
Affected
- Ollama 0.34.2 up to, but not including, 0.35.0 (per CERT Polska)
- Exploitation requires write access of the server process to /usr/lib/ollama, the default in most Docker images
- VulDB lists the flaw up to 0.34.9; the lower bound is not confirmed by Ollama
Fixed in
- Ollama 0.35.0 or later
Workaround
- No workaround documented by the vendor.
- Limit network access to the Ollama API to the clients that need it.
- Remove write permissions of the service process on /usr/lib/ollama and other directories from which code is loaded.
Exploitation
- A public proof-of-concept exists (per the Italian CSIRT ACN).
- No exploitation reported; not marked as known exploited in the sources reviewed.
- Exploitation in the wild: unknown.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS: 0.00714 at the time of the Vulners record.
Our recommendation
- Update all Ollama instances, including Docker images and packaged builds, to 0.35.0 or later.
- Until patched, restrict network access to the Ollama API and remove write access to /usr/lib/ollama.
- Check whether Ollama instances are reachable from untrusted networks.
- After patching, check the model store and /usr/lib/ollama for unexpected files; rebuild containers from a fresh image if a compromise is suspected.
- Monitor logs for unusual /api/pull requests.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
striga-ai/CVE-2026-103663
Research sources
- CERT Polska advisory CVE-2026-103663 cert.pl
- OSV record CVE-2026-103663 osv.dev
- ACN alert on public PoC for CVE-2026-103663 www.acn.gov.it
- Technical analysis of the model delivery path (dev.to) dev.to
- Third-party check guide (dev.to) dev.to
- Researcher write-up on digestToPath issues (GitHub) github.com
- VulDB entry CVE-2026-103663 vuldb.com
- Ollama ollama.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:11.
Original description (NVD)
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.
NVD references (2)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.