CVE-2026-108262

Name of the Vulnerable Software and Affected Versions DDEV versions 1.25.2 through 1.25.3

Description The Untar function in pkg/archive/archive.go validates absolute tar symlink targets after rebasing them beneath a destination, but creates the symlink using the raw absolute Linkname. This allows a crafted archive to plant a host-absolute symlink and use a subsequent regular-file entry to write files outside the extraction directory. This issue is reachable via remote add-on retrieval and database or file imports. Overwriting shell startup files, Git hooks, or cron entries can result in code execution within the context of the DDEV user.

Recommendations Update to version 1.25.4.