CVE-2026-7020

A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagegen/transfer/transfer.go of the component Tensor Model Transfer Handler. The manipulation of the argument digest results in path traversal. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7020.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "0.20.0"
                },
                {
                    "last_affected": "0.20.1"
                },
                {
                    "last_affected": "0.20.2"
                }
            ]
        }
    ],
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/ollama/ollama

Affected ranges

Type

GIT

Repo

https://github.com/ollama/ollama

Events

Introduced

de9673ac3fb1c57fbf6e5e194f1f3dc5a8b48668

Last affected

4589fa2cf5afd15fb19aca96c15b5fbf885d11cf

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.20.0"
        },
        {
            "last_affected": "0.20.2"
        }
    ]
}

Affected versions

v0.*

v0.20.0

v0.20.1

v0.20.1-rc0

v0.20.1-rc1

v0.20.1-rc2

v0.20.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-7020.json"