Ollama: path traversal in /api/pull layer digests writes outside the model store and executes as root on restart

Impact

digestToPath does not validate layer digests, so an unauthenticated caller of /api/pull can push a traversal sequence as a digest and have a file of their choosing written anywhere the server process can write. In the default Ollama Docker images the process can write /usr/lib/ollama, which the server loads on startup, so the next restart executes the planted binary as root inside the container. An operator who exposes an Ollama endpoint to tenants or to a shared internal network is handing out arbitrary file write on the GPU node now and code execution at the next restart - and a restart is exactly what an operator does when the model server looks unhealthy. The CVSS 4.0 vector marks user interaction as passive, which matches that restart dependency.

Who can reach it

Any unauthenticated client that can reach the Ollama HTTP API, including any tenant pod on a network where an inference endpoint is routable. Execution lands on the subsequent server restart.

What to do

Upgrade to Ollama 0.35.0 or later and restart the server - a daemon restart or container image roll per node, no reboot. Until then, restrict the API to trusted callers at the network layer and do not restart a server you suspect was targeted before inspecting /usr/lib/ollama and the model store for unexpected files, since restarting is the step that executes the payload.

References

Related entries

• Flowise: SQLite Record Manager config override gives an authenticated user root code execution in the containerCVE-2026-69259 · Flowise SQLite Record Manager node (additionalConfig database path override)Critical
• Flowise: custom-function sandbox escape via puppeteer.launch gives command execution as the Flowise userCVE-2026-73483 · Flowise (/api/v1/node-custom-function, vm2/@flowiseai/nodevm sandbox)Critical
• TensorFlow / Keras: Arbitrary code execution via unsafe YAML deserialization of model configCVE-2021-37678 · TensorFlow / KerasCritical
• MLflow (tracking server): Path traversal (`\..\filename`)CVE-2023-1177 · MLflow (tracking server)Critical
• Ray (dashboard /static/ file handler): Path traversal under the dashboard's /static/ route lets an unauthenticatedCVE-2023-6020 · Ray (dashboard /static/ file handler)Critical
• MLflow (LFI via URI parsing): Local file inclusion — read arbitrary filesCVE-2024-3573 · MLflow (LFI via URI parsing)Critical