What it is
Storage initializers, model downloaders and cache backends build local paths by joining object keys, digests, manifest entries or layer names. Where containment is not enforced after resolution, writes and reads escape the directory.
Path handling is spread across per-backend code. One backend gets the check and the siblings do not, because the check followed a specific report rather than the class.
Variants and records
Digest used as a path
A model name or checksum string from a manifest is used to build a file path without checking its format. A crafted value points outside the model folder, and the server writes or reads arbitrary files.
Ollama before 0.1.34, CVE-2024-37032 ("Probllama"), reaching arbitrary file write and code execution. Published 2024-05-31.
One rule. One containment helper used by every backend and tested per backend: resolve first, then verify the result is under the root.
Check your stack
Tests
Each test has a positive control: a condition under which it must fail. A test that cannot fail proves nothing. These are procedures. Hedgerow has not run them.
Traversal key
- Do
- Request an object whose key contains ../ and a canary name.
- Pass
- No file outside the root.
- Must fail when
- A backend without the containment check.
Per-backend diff
- Do
- Run the same traversal test against every backend.
- Pass
- Every backend refuses.
- Must fail when
- A backend known to lack the check is included. If every backend passes, check the test.
Symlink swap
- Do
- Place a symlink between the check and the write.
- Pass
- The write is refused.
- Must fail when
- A resolve-then-write implementation.
Mapping to AISVS, ATLAS and CWE
| Framework | Mapping |
|---|---|
| OWASP AISVS 1.01 | No requirement found for path containment in model or artifact storage, by keyword search of 1.01. 6.1.2 (artifacts downloaded only from approved sources) is adjacent, not equivalent. |
| MITRE ATLAS 5.6.0 | No technique fits well. |
| CWE | CWE-22 Improper Limitation of a Pathname to a Restricted Directory, CWE-59 Improper Link Resolution Before File Access (Hedgerow proposals). |
Controls
- One containment helper, used by every backend, tested per backend.
- Resolve first, then verify the result is under the root.
- Extract archives with an explicit per-entry check, in an unprivileged sandbox with no credentials.
- Reject symlink traversal outright for untrusted extraction.
What this page does not claim
- The tests have not been run by Hedgerow.
- Standards mappings reflect the versions named and may change as they do.
- A cited record shows the mechanism occurred in at least one implementation. It does not say any given system is affected.