CVE-2026-103663

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103663
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103663.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103663
Published
2026-10-08T13:19:04Z
Modified
2026-10-10T02:47:21Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Path Traversal leading to Remote Code Execution in Ollama
Details

Ollama is vulnerable to path traversal in the /api/pull endpoint due to insufficient validation of layer digests by the digestToPath function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. 

Critically if the server process has write access to /usr/lib/ollama (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root.

This issue was fixed in version 0.35.0.

Database specific 
{
    "cna_assigner": "CERT-PL",
    "cwe_ids": [
        "CWE-23",
        "CWE-913"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103663.json"
}
References

Affected packages

Git / github.com/ollama/ollama

Affected ranges

Type
GIT
Repo
https://github.com/ollama/ollama
Events
Introduced
dfabde4539e42ba1e1eab50a3a50b88aea7958a0
Fixed
cc4069396f3ad2c370c53eed2e4a42ac13adab84
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.34.2"
        },
        {
            "fixed": "0.35.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.34.2
v0.34.3
v0.34.3-rc0
v0.34.3-rc1
v0.34.4
v0.34.4-rc0
v0.34.4-rc1
v0.35.0-rc0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103663.json"