CVE-2024-37032

CVE-2024-37032 is a critical path traversal vulnerability affecting Ollama versions prior to 0.1.34, stemming from insufficient validation of digest formats when retrieving model paths. This flaw allows attackers to manipulate paths, potentially leading to unauthorized access or execution. With a CVSS score of 8.8 (High), this vulnerability is easily exploitable over the network with low privileges and no user interaction, enabling full compromise of confidentiality, integrity, and availability. Its EPSS score of 0.938150 indicates a very high probability of exploitation. Exploit code, including Nuclei templates for Remote Code Execution, is publicly available, and the vulnerability has garnered significant community attention with 7 mentions and 4 media articles. While not yet in CISA's KEV catalog, its high FAUCET Risk Score of 99/100 and widespread discussion suggest active exploitation is highly probable.