High

Path Traversal RCE in Ollama for Windows Updater

IdentifiersCVE-2026-42249CWE-22· Improper Limitation of a Pathname…

CVE-2026-42249 is a remote code execution vulnerability in the Ollama for Windows update mechanism. During update downloads, the application derives local file path components from attacker-controlled HTTP response headers, specifically noted in the provided content as the ETag header, and passes those values directly to filepath.Join without sanitization or validation. Because path traversal sequences such as ../ are not neutralized, an attacker can cause the updater to resolve paths outside the intended update staging directory and write files to arbitrary locations accessible to the current user. The issue affects tested Ollama for Windows versions 0.12.10 through 0.17.5; other versions may also be vulnerable but were not tested. The flaw is especially dangerous because Ollama for Windows performs silent automatic updates, and when combined with CVE-2026-42248, which allows unsigned or untrusted update payloads to be accepted, the attacker can place a malicious executable in locations such as the Windows Startup directory and obtain automatic execution.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows arbitrary file write outside the updater's staging directory, including placement of attacker-controlled executables in user-writable autostart locations such as the Windows Startup directory. On its own, this can lead to arbitrary code execution in the current user's context when the written executable is launched. When chained with CVE-2026-42248, the attacker can deliver a malicious update payload, place it in a sensitive execution path, and achieve silent, automatic, and persistent code execution without user interaction or user awareness.

Mitigation

If you can’t patch tonight, do this now.

Until a vendor patch is available, disable Ollama auto-updates on Windows and perform manual updates only from official Ollama releases. Reduce the attack surface by preventing attacker influence over update responses: do not override update URLs to untrusted infrastructure, protect DNS resolution, and prevent TLS interception by untrusted intermediaries. Monitor for unexpected files written outside the updater staging area, especially in user-writable persistence locations such as the Windows Startup directory, and remove suspicious Startup entries if present.

Remediation

Patch, then assume compromise.

Apply a vendor fix once available that sanitizes and canonicalizes all header-derived path components before use, rejects traversal sequences and absolute paths, constrains writes to a fixed update staging directory, and verifies that the final resolved path remains within that directory. Because the provided content states the issue remained unpatched after disclosure, no confirmed fixed version is available from the supplied data. The updater should also be hardened in conjunction with CVE-2026-42248 by enforcing cryptographic signature verification and trust validation for downloaded update packages before staging or execution.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

OllamaOllamaapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

thecybersecguruNews

May 11, 2026

Ollama RCE Vulnerability: Bleeding Llama & Windows Exploits | The CyberSec Guru

A Windows Ollama updater path traversal issue caused by unsanitized ETag header values being used in file paths, enabling an attacker-controlled update server to write payloads into the Startup folder for persistence when chained with missing signature verification.

cert polskaNews

Apr 1, 2026

Vulnerabilities in Ollama software | CERT Polska

A remote code execution vulnerability in Ollama for Windows' update mechanism caused by path traversal via attacker-controlled HTTP response headers, allowing arbitrary file write and execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6