CVE-2026-7020

Executive Summary

CVE-2026-7020 is a path traversal vulnerability discovered in Ollama up to version 0.20.2. The flaw resides in the digestToPath function within the Tensor Model Transfer Handler (x/imagegen/transfer/transfer.go). By manipulating the digest argument, an attacker can perform path traversal attacks remotely. The attack is characterized by high complexity and is reported as difficult to exploit. The vendor was contacted but did not respond, and a public exploit has been released. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public availability of exploit code increases the risk.

Supply Chain & Package Security

Ollama is a Go-based application. The vulnerability affects the core binary and its model transfer functionality. Since no official patch or advisory has been released, users must rely on manual mitigation or restrict access to the vulnerable endpoint. The Go ecosystem does not have a direct package dependency for this vulnerability, but the binary distribution is affected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 5.6 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – requires specific conditions or knowledge of the digest format.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited file read.
• Integrity Impact: Low (I:L) – limited file write/overwrite.
• Availability Impact: Low (A:L) – limited service disruption.

Threat Level: Medium. The high complexity and low impact reduce immediate risk, but public exploit code and lack of patch elevate the threat for targeted attacks.

Deep Dive & Mechanics

The vulnerability is in the digestToPath function in x/imagegen/transfer/transfer.go. This function is responsible for converting a digest (hash) into a file path for storing or retrieving model tensors. The function does not properly sanitize the digest input, allowing an attacker to inject path traversal sequences (e.g., ../).

Root Cause: The digest argument is used directly in file path construction without validation or sanitization. An attacker can supply a crafted digest like ../../etc/passwd to read arbitrary files or ../../tmp/evil to write files outside the intended directory.

Attack Flow:

1. Attacker sends a crafted request to the Tensor Model Transfer Handler with a malicious digest parameter.
2. The digestToPath function constructs a file path using the unsanitized input.
3. The handler performs file operations (read/write) on the resulting path, leading to path traversal.

Impact: An attacker could read sensitive files (e.g., configuration, credentials) or write malicious files (e.g., overwrite model files, plant backdoors) on the server.

Vulnerable vs. Patched Code

Vulnerable Code (Ollama <= 0.20.2):

func digestToPath(digest string) string {
    return filepath.Join(basePath, digest)
}

Patched Code (Hypothetical):

func digestToPath(digest string) string {
    // Sanitize digest to prevent path traversal
    sanitized := strings.ReplaceAll(digest, "../", "")
    sanitized = strings.ReplaceAll(sanitized, "..\\", "")
    return filepath.Join(basePath, sanitized)
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Ollama server with version <= 0.20.2 running and exposed on the network.
• Knowledge of the transfer endpoint (e.g., /api/transfer).

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., POST /api/transfer).
2. Craft a request with a malicious digest parameter:

   {
     "digest": "../../etc/passwd"
   }
   

3. Send the request to the server.
4. Observe the response containing the contents of /etc/passwd.

Example cURL Command:

curl -X POST http://target:11434/api/transfer \
  -H "Content-Type: application/json" \
  -d '{"digest":"../../etc/passwd"}'

Note: The exact endpoint and parameter names may vary. The exploit is publicly available but not included here due to ethical considerations.

Blue Team

Detection:

• Monitor for requests to the transfer endpoint with suspicious digest values containing ../ or ..\\.
• Look for file access patterns outside the expected model storage directory.

Mitigation:

• Restrict network access to the Ollama server.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Monitor logs for unusual file access errors.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/transfer with digest containing ../ or ..\\.
  • Unusual file read/write operations on the server.
• File System IOCs:
  • Unexpected files in the model storage directory.
  • Modified or deleted model files.
• Log IOCs:
  • Error logs indicating path traversal attempts (e.g., "file not found" for paths outside expected directory).

Detection Engineering

YARA Rule

rule CVE_2026_7020_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Ollama transfer requests"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-7020"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $digest_key = "\"digest\""
    condition:
        $digest_key and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2026-7020 Path Traversal in Ollama Transfer
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Ollama transfer requests
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/transfer'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of digests with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-7020 Ollama Path Traversal Attempt";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/api/transfer";
    http_uri;
    content:"../";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-7020;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Limit access to the Ollama server to trusted IPs only.
2. Implement WAF Rules: Block requests containing ../ or ..\\ in the digest parameter.
3. Monitor Logs: Enable detailed logging and monitor for path traversal attempts.

Long-Term Fix:

• Apply input validation and sanitization to the digest parameter in the digestToPath function.
• Use a whitelist of allowed characters (e.g., alphanumeric and hyphens) for digests.
• Consider using a secure file path library that prevents traversal.

Patch Status: No official patch available. Users should consider upgrading to a patched version once released or applying the above mitigations.

Valters IT

{/* [Security Hash: AF1A19A53AB3209258556EFA] */}