CVE-2026-7020 Ollama Tensor Model Transfer transfer.go digestToPath path traversal
Remote attackers can exploit a path traversal flaw in Ollama's tensor model transfer to read or modify files, requiring high complexity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7020?
CVE-2026-7020 is a medium-severity path traversal vulnerability in Ollama, published on 26 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagegen/transfer/transfer.go of the component Tensor Model Transfer Handler. The manipulation of the argument digest results in path traversal. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-22
Which versions are affected by CVE-2026-7020?
3 open source packages ship an affected version, including github.com/ollama/ollama. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ollama/ollama Go | All versions | None |
github.com/ollama/ollama Go | All versions to 0.20.2 | None |
github.com/ollama/ollama Go | All versions to 0.20.2 | None |
Products include Ollama Ollama.
How do I fix CVE-2026-7020?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-7020 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7020 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Ollama
- CVE-2025-63389 Ollama Platform has missing authentication enabling attackers to perform model management operations
- CVE-2024-45436 Ollama can extract members of a ZIP archive outside of the parent directory
- CVE-2026-7482 Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers
- CVE-2024-37032 Ollama does not validate the format of the digest (sha256 with 64 hex digits)
- CVE-2025-15514 Ollama Multi-Modal Model Image Processing NULL Pointer Dereference
Sources
Also known as GHSA-x99g-8v8j-25j2, GO-2026-5750, MINI-3xqh-w656-wmp7, MINI-x368-6cp9-mfw9.