This vulnerability, identified as CWE‑22, allows manipulation of the digest argument in the digestToPath function of Ollama’s Tensor Model Transfer Handler. By supplying a crafted digest value, an attacker can cause the function to resolve paths outside the intended directory, resulting in path traversal that can read or overwrite arbitrary files on the host. The flaw is remote‑usable with high complexity and difficult exploitation, and a public exploit has already been released.

Ollama versions up to 0.20.2 are affected. Any deployment that exposes the Tensor Model Transfer Handler to external clients is at risk. No other vendors or products are listed as impacted.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation at present. Nevertheless, because the vulnerability permits arbitrary file access from a remote attacker, it could be leveraged to pivot, exfiltrate data, or enable further compromise once foothold is gained. Based on the description, the likely attack vector is remote, though specific network reachability depends on the deployment configuration.