CVE-2025-44779: 
NixOS vulnerability analysis and mitigation

CVE-2025-44779 is an arbitrary file deletion vulnerability in Ollama, an open-source framework for running large language models locally. The flaw affects Ollama v0.1.33 and earlier (all versions below 0.1.34), allowing attackers to delete arbitrary files by sending a crafted packet to the /api/pull API endpoint. It was published on August 7, 2025, with a researcher blog post dating the initial discovery to March 2025. The vulnerability carries a CVSS v3.1 base score of 6.6 (Medium/Moderate) (Github Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) in the /api/pull endpoint, with path traversal characteristics (CWE-22) enabling access to files outside the intended directory. An attacker can craft a malicious request to the /api/pull endpoint that manipulates file path parameters, causing Ollama to delete arbitrary files on the host system without proper sanitization or boundary enforcement. The attack vector is local (AV:L) and requires user interaction, suggesting the crafted packet may need to be processed in the context of a user-initiated action or a locally accessible API. A technical write-up by the discoverer is publicly available at https://a1batr0ss.top/2025/08/06/CVE-2025-44779-Ollama-arbitrary-file-deletion (Github Advisory).

Successful exploitation allows an attacker to delete arbitrary files accessible to the Ollama process, which can result in data loss, system instability, or denial of service by removing critical application or operating system files. The vulnerability also carries low confidentiality and integrity impacts, suggesting limited potential for data exposure or modification beyond file deletion. In environments where Ollama runs with elevated privileges, the blast radius of arbitrary file deletion could extend to system-critical files, potentially rendering the host inoperable (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code confirmed at this time, and no evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.021% (0.000210), placing it in the 24th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Github Advisory).

1. Reconnaissance: Identify a target system running Ollama v0.1.33 or earlier with the API accessible (default port 11434). Ollama's REST API is typically bound to localhost but may be exposed on the network in misconfigured deployments.
2. Craft malicious request: Construct a crafted HTTP POST request to the /api/pull endpoint with a manipulated model name or path parameter containing path traversal sequences (e.g., ../../etc/passwd or similar) designed to reference a target file outside the intended model directory.
3. Send the packet: Transmit the crafted request to the Ollama API endpoint: curl -X POST http://<target>:11434/api/pull -d '{"name": "../../path/to/target/file"}'.
4. Trigger file deletion: The server processes the malicious input without proper validation, causing Ollama to delete the specified arbitrary file on the host filesystem.
5. Achieve objective: Depending on the targeted file, the attacker can cause denial of service (deleting critical system or application files), disrupt Ollama model availability, or destabilize the host environment (Github Advisory).

• Network: Unusual or repeated HTTP POST requests to /api/pull on port 11434 containing path traversal sequences (e.g., ../, %2e%2e%2f) in the request body; requests originating from unexpected source IPs.
• Logs: Ollama server logs showing /api/pull requests with anomalous model name parameters containing directory traversal patterns; file system errors or deletion events logged around the time of API calls.
• File System: Unexpected disappearance of files outside the Ollama model directory (e.g., /usr/share/ollama/.ollama/models); missing configuration, binary, or system files that correlate with Ollama process activity.
• Process: Ollama process performing file operations (unlink/delete syscalls) on paths outside its expected working directory, detectable via auditd or eBPF-based monitoring tools.

Users should upgrade Ollama to version 0.1.34 or later, which contains the patch for this vulnerability (Github Advisory). As interim workarounds, restrict network access to the Ollama API (port 11434) using firewall rules or network segmentation to limit exposure to trusted hosts only. Additionally, run Ollama under a least-privilege service account with minimal filesystem permissions to reduce the impact of arbitrary file deletion, and monitor API logs for suspicious /api/pull requests with path traversal patterns.

The vulnerability was initially documented in a researcher blog post in March 2025 and formally disclosed in August 2025. Red Hat tracked the issue via Bugzilla and assigned it medium severity. No significant public commentary from major security researchers or widespread media coverage has been identified beyond the initial disclosure and standard vulnerability database entries (Red Hat Bugzilla).