CVE-2024-45436

Ollama can extract members of a ZIP archive outside of the parent directory

7.5 HighPublic exploitFix available

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.56%Up 2.5 points since Aug 29, 2024

What each source reports

NVD Score used 7.5

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Record: CVE-2024-45436
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List 9.1

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Record: CVE-2024-45436
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2024-2532 9.1

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Record: EUVD-2024-2532
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-846m-99qv-67mg 8.7

Ollama can extract members of a ZIP archive outside of the parent directory

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Record: GHSA-846m-99qv-67mg
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSV 9.1

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Record: CVE-2024-45436
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVGHSA-846m-99qv-67mg 8.7

Ollama can extract members of a ZIP archive outside of the parent directory

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Record: GHSA-846m-99qv-67mg
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSVGO-2024-3104 No score

Ollama can extract members of a ZIP archive outside of the parent directory in github.com/ollama/ollama

Ollama can extract members of a ZIP archive outside of the parent directory in github.com/ollama/ollama

Record: GO-2024-3104
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14599-1 No score

govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14599-1
Updated: 2026-11-02

Affected products

ollama

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/ollama/ollama` Go	before 0.1.47	0.1.47
`govulncheck-vulndb` openSUSE:Tumbleweed From an advisory covering 21 CVEs	before 0.0.20241213T205935-1.1	0.0.20241213T205935-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	srcx404/CVE-2024-45436	2025-04-17

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45436 is a high vulnerability (CVSS 7.5) in Ollama, published August 29, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.56%, the 85th percentile. Fixed in github.com/ollama/ollama 0.1.47.

References

Show 23 moreShow less