Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2024-39722: Ollama exposes server files via path traversal in API
CVE-2024-39722 · published 2 years ago
Summary
Ollama, a web application, may leak the existence of certain files on the server. This could potentially allow an attacker to gather information about the server's directory structure. To fix this issue, update to version 0.1.46 or later.
What to do
- Update ollama ollama to version 0.1.46 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ollama | ollama |
< 0.1.46 cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route.
An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route.
References
- https://www.oligo.security/blog/more-models-more-probllms Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39722... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-39722 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published31 Oct 2024
Updated30 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta