An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the server.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.oligo.security/blog/more-models-more-probllms | Third Party Advisory Exploit |
Configurations
History
13 May 2025, 13:32
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:* | |
| First Time |
Ollama ollama
Ollama |
|
| References | () https://www.oligo.security/blog/more-models-more-probllms - Third Party Advisory, Exploit |
01 Nov 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
31 Oct 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-31 20:15
Updated : 2025-05-13 13:32
NVD link : CVE-2024-39719
Mitre link : CVE-2024-39719
JSON object : View
Products Affected
ollama
- ollama
CWE
No CWE.