High severity · published Oct 31, 2024
CVE-2024-39722
An issue was discovered in Ollama before 0.1.46
7.5
CVSS
4%
EPSS
No
On KEV
Description
An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OL
Ollama · Ollama
before 0.1.46 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39722
Exploit
https://www.oligo.security/blog/more-models-more-probllms
More from Ollama
9.8
CVE-2026-42249
Remote Code Execution in Ollama via Update Mechanism
9.8
CVE-2026-42248
Missing Signature Verification for Updates in Ollama
9.8
CVE-2025-63389
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3
9.4
CVE-2026-103663
Path Traversal leading to Remote Code Execution in Ollama
9.1
CVE-2026-7482
Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers