Ollama Zip Slip Path Traversal — CVE-2024-45436 PoC

WARNING: MALICIOUS FILE — SECURITY RESEARCH ONLY

Vulnerability

File: server/model.go Function: extractFromZipFile() CVE: CVE-2024-45436

Description

Ollama < 0.1.47 does not validate extracted file paths stay within the models directory. A ZIP with path traversal filenames like ../../../../etc/ld.so.preload writes files outside the intended directory.

// Vulnerable: no path prefix validation
for _, f := range zip.File {
    path := filepath.Join(modelsDir, f.Name)
    // f.Name = "../../../../etc/ld.so.preload" → writes outside models dir
}

Impact

Severity: Critical (CVSS 9.1)
Attack Vector: Serve malicious model ZIP → Ollama extracts → arbitrary file write
Result: RCE via /etc/ld.so.preload overwrite
Fix: Ollama 0.1.47+ adds prefix validation

Reproduction

# Malicious ZIP contains: ../../../../etc/ld.so.preload
# When Ollama extracts it, file is written outside models dir

References

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support