--- title: "CVE-2026-103663: Ollama Path Traversal Vulnerability and RCE Risk Explained" description: "CVE-2026-103663: CVSS 4.0 9.4 (CRITICAL). Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by…" url: "https://www.gowrishankar.me/blog/cve-2026-103663-ollama-path-traversal-rce" author: "Gowri Shankar Balasubramaniam" published: 2026-10-08T22:27:13.753Z category: "Vulnerability Analysis" tags: ["CVE","CWE-23","CWE-913","critical severity","vulnerability"] --- # CVE-2026-103663: Ollama Path Traversal Vulnerability and RCE Risk Explained > Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. ## Key takeaways - CVE-2026-103663 has CVSS 4.0 9.4 (CRITICAL). - It is not in the CISA Known Exploited Vulnerabilities catalogue at the time of writing. - Apply the vendor fix or mitigation as soon as possible. ## Summary Ollama is vulnerable to path traversal in the \`/api/pull\` endpoint due to insufficient validation of layer digests by the \`digestToPath\` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store.  Critically if the server process has write access to \`/usr/lib/ollama\` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. **This issue was fixed in version 0.35.0.** ## At a glance | Item | Value | | --- | --- | | CVE | CVE-2026-103663 | | CVSS 4.0 | 9.4 (CRITICAL) | | Vulnerable versions | From 0.34.2 to 0.35.0 | | Weakness | CWE-23, CWE-913 | | Known exploited (CISA KEV) | Not listed | | NVD status | Awaiting Analysis | | Published | 2026-10-08 | | Last modified | 2026-10-08 | ## What to do - Check the vendor advisory for fixed versions and mitigations. - Prioritise by exposure: internet-facing and unauthenticated attack paths first. ## Analysis > **Note:** **CVE-2026-103663** is a **critical path traversal vulnerability in Ollama** that can potentially lead to **remote code execution (RCE)**. > > - **Affected component:** Ollama `/api/pull` endpoint > - **Vulnerability:** Path Traversal (CWE-23) > - **Attack:** An unauthenticated attacker can manipulate model-layer paths and potentially write files outside the intended model directory. > - **Impact:** Arbitrary file write → potential malicious binary placement → **RCE**, potentially with **root privileges** depending on deployment configuration. > - **Severity:** **Critical - CVSS 9.4** > - **Main risk:** Internet- or network-exposed Ollama instances, particularly **Docker deployments running with excessive privileges**. > - **Mitigation:** Upgrade Ollama to a confirmed fixed release, restrict access to port **11434**, enforce authentication/network controls, and review container/file-system permissions. > - **Detection:** Monitor `/api/pull` requests, suspicious path traversal patterns, unexpected files under Ollama directories, and unusual Ollama restarts. > > **Security takeaway:** Treat Ollama as production infrastructure—not simply an AI development tool. Any externally accessible Ollama API should be considered a high-priority security exposure. ## Questions and answers ### Is CVE-2026-103663 being actively exploited? CVE-2026-103663 is not listed in the CISA Known Exploited Vulnerabilities catalogue at the time of writing. ### How severe is CVE-2026-103663? NVD rates it 9.4 (CRITICAL) under CVSS 4.0 ### What should I do about CVE-2026-103663? Apply the vendor fix or mitigation, prioritising systems that are reachable from the internet. ## Sources - [NVD: CVE-2026-103663]() - [CVE record: CVE-2026-103663]() --- Source: https://www.gowrishankar.me/blog/cve-2026-103663-ollama-path-traversal-rce