CVE-2026-103663: Path Traversal leading to Remote Code Execution in Ollama
Ollama is vulnerable to path traversal in the /api/pull endpoint due to insufficient validation of layer digests by the digestToPath function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store.
Critically if the server process has write access to /usr/lib/ollama (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root.
This issue was fixed in version 0.35.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ollamato a version that resolves this vulnerability.Fixed in 0.35.0
Event History
Frequently Asked Questions
Which deployments are most exposed to root-level code execution?
Deployments where the Ollama server process can write to /usr/lib/ollama are at particular risk. This write access is described as the default in most Ollama Docker images.
What does an attacker need to exploit this issue?
An attacker needs remote access to the /api/pull endpoint and does not need authentication. They can supply a path traversal sequence as a layer digest to write a malicious binary outside the model store.
When would the malicious file execute?
The malicious file is loaded and executed on the next server restart. In the described writable /usr/lib/ollama scenario, it executes as root.
What version contains the fix?
The issue was fixed in Ollama version 0.35.0.