CVE-2026-7020: Ollama Path Traversal Vulnerability

CVE-2026-7020 Overview

A path traversal vulnerability has been discovered in Ollama versions up to 0.20.2. This security flaw affects the digestToPath function within the file x/imagegen/transfer/transfer.go of the Tensor Model Transfer Handler component. By manipulating the digest argument, an attacker can perform path traversal attacks remotely. The attack is characterized by high complexity and the exploitability is reported as difficult.

Critical Impact

Remote attackers can potentially traverse file system directories through the Tensor Model Transfer Handler, potentially accessing sensitive files or system resources outside the intended directory scope.

Affected Products

• Ollama versions up to 0.20.2
• Tensor Model Transfer Handler component (x/imagegen/transfer/transfer.go)

Discovery Timeline

• 2026-04-26 - CVE-2026-7020 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7020

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The flaw exists in the Tensor Model Transfer Handler, specifically within the digestToPath function located in x/imagegen/transfer/transfer.go.

The vulnerability allows remote attackers to manipulate the digest parameter to escape the intended directory structure. By crafting malicious input containing directory traversal sequences (such as ../), an attacker could potentially access files outside the designated model storage directories.

Despite being remotely exploitable, the attack complexity is high, making exploitation difficult in practice. The vendor was contacted early about this disclosure but did not respond.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of the digest argument in the digestToPath function. The function fails to properly validate or canonicalize the path before using it, allowing directory traversal sequences to remain in the path and be processed by file system operations.

Path traversal vulnerabilities typically occur when user-supplied input is used to construct file paths without adequate checks to ensure the resulting path stays within the intended directory boundaries.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker would need to send a specially crafted request to the Tensor Model Transfer Handler containing a malicious digest value with path traversal sequences.

The technical details of the vulnerability can be found in the VulDB submission. The exploit has been disclosed publicly, though the high attack complexity makes successful exploitation challenging.

Detection Methods for CVE-2026-7020

Indicators of Compromise

• Unexpected file access attempts outside of model storage directories
• HTTP requests to the Tensor Model Transfer Handler containing ../ or encoded traversal sequences in the digest parameter
• Anomalous read operations on sensitive system files from the Ollama process

Detection Strategies

• Monitor Ollama application logs for path traversal patterns in digest parameters
• Implement Web Application Firewall (WAF) rules to detect and block requests containing directory traversal sequences
• Deploy file integrity monitoring on sensitive directories to detect unauthorized access attempts

Monitoring Recommendations

• Enable detailed logging for the Tensor Model Transfer Handler component
• Monitor file system access patterns from the Ollama process for attempts to access files outside model directories
• Implement alerting for any requests containing encoded path traversal sequences (e.g., %2e%2e%2f)

How to Mitigate CVE-2026-7020

Immediate Actions Required

• Review and restrict network access to the Ollama Tensor Model Transfer Handler endpoint
• Implement input validation at the network perimeter to reject requests with path traversal patterns
• Consider deploying the application in a containerized environment with restricted file system access

Patch Information

At the time of disclosure, the vendor had not responded to notification attempts. Users should monitor for security updates from Ollama and upgrade to patched versions when available. Review the VulDB vulnerability entry for the latest status on patches and fixes.

Workarounds

• Implement a reverse proxy or WAF in front of Ollama that filters requests containing path traversal sequences
• Restrict file system permissions for the Ollama process to limit the impact of potential exploitation
• Use network segmentation to limit which systems can access the Tensor Model Transfer Handler endpoint

# Example: Restrict Ollama process file system access using AppArmor profile
# /etc/apparmor.d/ollama
profile ollama /usr/bin/ollama {
  # Allow read access only to model directories
  /var/lib/ollama/models/** r,
  # Deny access to sensitive system directories
  deny /etc/** rw,
  deny /root/** rw,
}