Bug 2547956 (CVE-2026-103663)

Summary: CVE-2026-103663 Ollama: Path Traversal leading to Remote Code Execution in Ollama
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dschmidt, ikhan, jlanda, kshier, rbobbitt, rjohnson, simaishi, stcannon, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Ollama. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution by exploiting a path traversal flaw in the model pull application programming interface (API) endpoint. By supplying a crafted layer identifier, an attacker can write malicious files outside the intended storage location. If these files are written to executable application directories, the server loads and executes them upon restart, compromising the host system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-08 13:41:40 UTC 
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. 

Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root.


This issue was fixed in version 0.35.0.