{"data":{"id":"21091634-8bbc-453d-833d-35b411b5074b","title":"CVE-2024-45436: extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent…","summary":"CVE-2024-45436 affects extractFromZipFile in model.go in Ollama before 0.1.47. The flaw lets the function extract members of a ZIP archive outside the parent directory, which is classified as CWE-22 (Path Traversal). NVD has not yet provided an assessment.","solution":"Fix referenced in the source: upgrade to 0.1.47 or later. The source links the compare view v0.1.46...v0.1.47 and pull request #5314 as patch references.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-45436","publishedAt":"2024-08-29T07:15:05.460Z","cveId":"CVE-2024-45436","cweIds":["CWE-22","CWE-22"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/ollama/ollama@< 0.1.47 (fixed: 0.1.47)"],"affectedPackageNames":["github.com/ollama/ollama"],"affectedPackageRefs":["go:github.com/ollama/ollama"],"affectedVendors":[],"affectedVendorsRaw":["Ollama"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Ollama path traversal in ZIP extraction in extractFromZipFile","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0256,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-846m-99qv-67mg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:20.865Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-06-27T04:38:21.000Z","daysToFix":-63,"fixCheckedAt":"2026-10-29T21:45:33.929Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/ollama/ollama","fixedVersion":"0.1.47","matchedVersion":"v0.1.47","fixReleasedAt":"2024-06-27T04:38:21.000Z","daysToFix":-63,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:45:33.775Z"}]}}