The vulnerability is an unvalidated path traversal in the /api/pull endpoint that allows an unauthenticated attacker to supply a crafted layer digest containing ‘..’ characters. The digestToPath function expands this to a file path outside the model store, enabling the attacker to write an arbitrary binary to the server’s filesystem. If the Ollama process has write permission to the default installation directory (/usr/lib/ollama), the attacker can drop a malicious file there. Upon restarting the server, the binary is loaded and executed with the rights of the server process, typically root, which grants full system control. The weakness is categorized as CWE‑22 (Path Traversal), CWE‑23 (Relative Path Traversal), and CWE‑913 (Insecure Execution of Malicious Code).

Any Ollama instance running a version earlier than 0.35.0, especially Docker images where the server process has write access to /usr/lib/ollama, is affected.

The CVSS score of 9.4 classifies this flaw as critical, and the EPSS score of 0.00714 (below 1%) indicates a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated remote attacker issuing an HTTP request to the /api/pull endpoint from the network. If the attacker can write to the model directory, the malicious binary will be executed when the service restarts, granting root-level control. The combination of high severity, broad potential exploitation preconditions, and remote access makes this a high-priority risk.