CVE-2026-103663

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.35.0

Description An unauthenticated remote attacker can exploit a path traversal issue via the '/api/pull' endpoint. This occurs because the digestToPath() function does not sufficiently validate layer digests, allowing the use of traversal sequences to write malicious binaries outside the intended model store. If the server process has write access to '/usr/lib/ollama', which is common in many Docker images, an attacker can place a malicious file in that directory. This file is then loaded and executed upon the next server restart, leading to remote code execution with root privileges.

Recommendations Update to version 0.35.0.