AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

OllamaGHSA-93jv-pvg8-hf3v

Ollama allows deletion of arbitrary files

Ollama

CVE-2025-44779 · Published Aug 7, 2025 · updated Jun 10, 2026

Medium6.6
Fix: upgrade to 0.1.34 or later
GitHub advisory

An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.

Affected versions

PackageAffectedFixed in
github.com/ollama/ollama
Go
< 0.1.340.1.34
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-20
Also known as
CVE-2025-44779, GO-2025-3851

More Ollama advisories

All Ollama
CriticalDec 18, 2025Ollama Platform has missing authentication enabling attackers to perform model management operationsCVE-2025-63389no fix yetMedium 6.9Jul 22, 2025Ollama vulnerable to Cross-Domain Token ExposureCVE-2025-51471no fix yetHigh 7.5May 16, 2025Ollama Server Vulnerable to Denial of Service (DoS) AttackCVE-2025-1975no fix yetHigh 7.5Mar 20, 2025Ollama Divide By Zero vulnerabilityCVE-2025-0317no fix yetHigh 7.5Mar 20, 2025Ollama Allocation of Resources Without Limits or Throttling vulnerabilityCVE-2025-0315no fix yetHigh 7.5Mar 20, 2025Ollama Denial of Service (DoS) via Null Pointer DereferenceCVE-2025-0312no fix yet