An unauthenticated remote attacker can exploit a path traversal issue via the '/api/pull' endpoint. This occurs because the `digestToPath()` function does not sufficiently validate layer digests, allowing the use of traversal sequences to write malicious binaries outside the intended model store. If the server process has write access to '/usr/lib/ollama', which is common in many Docker images, an attacker can place a malicious file in that directory. This file is then loaded and executed upon the next server restart, leading to remote code execution with root privileges.