CVE-2024-39722: ollama Path Traversal
CVSS: 7.5v3.1HighAnalyzed
Published 31-10-2024Last modified 01-11-2024
Vulnerability summary
CVE-2024-39722 is a high (CVSS 7.5) Path Traversal vulnerability in ollama. EPSS estimates a 3.94% chance of exploitation in the next 30 days, higher than 90.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
3.94%
0%100%
Low · -0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 31-10-2024PublishedVulnerability first disclosed.
- 01-11-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
3.94%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
-0.03 pp
From 3.97% on 21-09-2026
21-09-202621-10-2026
EPSS score3.94%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (oligo.security)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ollama1 product
- ollama< 0.1.46
1 vendor · 1 product