CERT Polska: Ollama path traversal vulnerability can lead to root RCE
Start here
CERT Polska disclosed a path traversal vulnerability in Ollama, CVE-2026-103663, affecting versions 0.34.2 through 0.35.0, fixed in 0.35.0. The vulnerability is in the /api/pull endpoint, where the digestToPath function insufficiently validates layer digests, allowing an unauthenticated remote attacker to pass a path traversal sequence as a layer digest and write malicious binaries outside the model storage directory. If the service process has write permissions to /usr/lib/ollama (as in most deployments), an attacker can overwrite binaries in that directory and thereby execute remote code with root privileges.
Generated by AI from reports · Updated 2 days ago
Progress timeline
- CERT PolskaSelectedCERT Polska: Ollama /api/pull path traversal can lead to remote code execution with root privileges
CERT Polska disclosed a path traversal vulnerability in Ollama, CVE-2026-103663, affecting versions 0.34.2 through 0.35.0, fixed in 0.35.0. The vulnerability is in the /api/pull endpoint; the digestToPath function insufficiently validates the layer digest, allowing an unauthenticated remote attacker to pass a path traversal sequence as the layer digest and write malicious binaries outside the model storage directory. If the service process has write access to /usr/lib/ollama (the default configuration of most Ollama Docker images), the attacker can write to that directory, and the file will be loaded and executed on the next server restart, achieving remote code execution with root privileges. The vulnerability was reported by Bartłomiej Dmitruk of striga.ai, and CERT Polska participated in coordinated disclosure.
Related discussion
Attention trend
New sources per day
- Oct 9New1 sources (1 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)