Ollama allows deletion of arbitrary files

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-44779 · ADVISORY
• a1batr0ss.top/2025/03/17/Ollama-arbitrary-file-deletion-vulnerability · WEB
• a1batr0ss.top/2025/08/06/CVE-2025-44779-Ollama-arbitrary-file-deletion · WEB
• ollama/ollama · PACKAGE
• a1batr0ss.top/2025/03/17/Ollama-arbitrary-file-deletion-vulnerability · Broken Link
• a1batr0ss.top/2025/08/06/CVE-2025-44779-Ollama-arbitrary-file-deletion · Broken Link
• GitHub Advisory GHSA-93jv-pvg8-hf3v · ADVISORY

Autres vulnérabilités de github.com/ollama/ollama

• CVE-2026-7482CRITIQUE 9.1Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker…
• CVE-2026-7020FAIBLE 3.7A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagegen/transfer/transfer.…
• CVE-2025-63389CRITIQUE 9.8A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The pla…
• CVE-2025-51471MOYENNE 6.9Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and …
• CVE-2025-1975ÉLEVÉE 7.5A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the man…