CVE-2025-44779: Ollama allows deletion of arbitrary files

August 7, 2025

An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.

References

a1batr0ss.top/2025/03/17/Ollama-arbitrary-file-deletion-vulnerability
a1batr0ss.top/2025/08/06/CVE-2025-44779-Ollama-arbitrary-file-deletion
github.com/advisories/GHSA-93jv-pvg8-hf3v
github.com/ollama/ollama
nvd.nist.gov/vuln/detail/CVE-2025-44779

Code Behaviors & Features

Detect and mitigate CVE-2025-44779 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →