CERT Polska: Ollama /api/pull path traversal can lead to remote code execution with root privileges

CERT Polska disclosed a path traversal vulnerability in Ollama, CVE-2026-103663, affecting versions 0.34.2 through 0.35.0, fixed in 0.35.0. The vulnerability is in the /api/pull endpoint; the digestToPath function insufficiently validates the layer digest, allowing an unauthenticated remote attacker to pass a path traversal sequence as the layer digest and write malicious binaries outside the model storage directory. If the service process has write access to /usr/lib/ollama (the default configuration of most Ollama Docker images), the attacker can write to that directory, and the file will be loaded and executed on the next server restart, achieving remote code execution with root privileges. The vulnerability was reported by Bartłomiej Dmitruk of striga.ai, and CERT Polska participated in coordinated disclosure.