PT-2026-34524

CVE-2026-32885

Published

2026-04-22

Updated

2026-11-10

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DDEV versions prior to 1.25.2

Description DDEV is an open-source tool for running local web development environments for PHP and Node.js. The software performs unsanitized extraction of archives from remote sources without path validation within the Untar() and Unzip() functions located in pkg/archive/archive.go.

Recommendations Update to version 1.25.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Snailsploit

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers