CVE-2026-7020 - Vulnerability Analysis
MediumCVSS: 5.6Last Updated: April 27, 2026
Ollama - Path Traversal
Published: April 26, 2026Updated: April 27, 2026PoC AvailableRemote Exploitable
Overview
Ollama <= 0.20.2 contains a path traversal caused by manipulation of the "digest" argument in x/imagegen/transfer/transfer.go Tensor Model Transfer Handler, letting remote attackers access arbitrary paths, exploit requires complex conditions.
Severity & Score
Severity: Medium
CVSS Score: 5.6
Impact
Remote attackers can access arbitrary file paths, potentially exposing sensitive data or system files.
Mitigation
Update to the latest version beyond 0.20.2.
References
Related Resources
Details
- CVE ID
- CVE-2026-7020
- Severity
- Medium
- CVSS Score
- 5.6
- Type
- path_traversal
- Status
- unconfirmed
CWE
- CWE-22
CVSS Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L