Probllama: Path Traversal to RCE in Ollama
Ask the local model runner to pull a model, and a crafted digest walks the write straight out of its lane.
| When | June 2024 |
|---|---|
| Target | Ollama (local LLM runner) |
| Researcher | Wiz Research (Sagi Tzadik) |
| Technique | Path traversal via unvalidated digest → RCE |
| CVE | CVE-2024-37032 — CVSS 8.8 (High) |
- 1An attacker crafts a model manifest with a malicious digest field
- 2A vulnerable Ollama pulls it; the digest isn't validated (path traversal)
- 3Files are overwritten at attacker-chosen paths, escalating to remote code execution
What happened
In 2024, Wiz Research disclosed Probllama (CVE-2024-37032) in Ollama, a widely-used tool for running LLMs locally. When pulling a model, Ollama insufficiently validated the manifest's digest field, allowing path traversal that overwrote files at attacker-chosen locations and escalated to remote code execution. Wiz found over 1,000 internet-exposed Ollama servers. Fixed in 0.1.34.
How the attack worked
The /api/pull flow trusted the digest string from a model manifest as a safe path component. A crafted value escaped the intended directory (path traversal), letting an attacker write to arbitrary locations — and from an arbitrary file write, reach code execution on the host.
Root cause
Attacker-influenced input used to build a filesystem path without validation — a classic traversal — in an AI tool commonly run with no authentication in front of it.
Why it matters
Local model runners are deployed casually and often exposed. A traditional web bug in one becomes a fleet of remotely-executable servers holding models and keys.
How to prevent it
- Patch to 0.1.34+.
- Never expose Ollama to the internet without a proxy and authentication.
- Only pull models from sources you trust.
FAQ
What was the flaw?
Ollama's /api/pull endpoint trusted a model manifest's digest field without validating it, so a crafted value produced path traversal — writing attacker-controlled files to arbitrary locations on the host and, from there, code execution.
Was it exploited in the wild?
It was a research disclosure; Wiz found 1,000+ exposed instances but no confirmed in-the-wild attacks. Its mechanism is a classic path-traversal RCE — in an AI tool that is frequently run without authentication.
How do you defend?
Patch to 0.1.34+, never expose an Ollama server to the internet without a proxy and authentication, and only pull models from sources you trust.
Sources
- Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) — Wiz Research
- CVE-2024-37032 — NVD