PT-2026-34524 · Ddev · Ddev

Snailsploit · Published 2026-04-22 · Updated 2026-05-11 · CVE-2026-32885

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DDEV versions prior to 1.25.2

Description DDEV is an open-source tool for running local web development environments for PHP and Node.js. The software performs unsanitized extraction of archives from remote sources without path validation within the Untar() and Unzip() functions located in pkg/archive/archive.go.

Recommendations Update to version 1.25.2.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32885

GHSA-X2XQ-QHJF-5MVG

Affected Products

Ddev

References · 9

• 🔥 https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf-5mvg · Exploit
• https://osv.dev/vulnerability/GHSA-x2xq-qhjf-5mvg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32885 · Security Note
• https://github.com/ddev/ddev/pull/8213 · Note
• https://github.com/ddev/ddev/commit/05cbe299770a590b89bfc8dddab33e61b4302e43 · Note
• https://github.com/ddev/ddev · Note
• https://github.com/ddev/ddev/releases/tag/v1.25.2 · Note
• https://twitter.com/CVEnew/status/2047012067471921206 · Twitter Post
• https://t.me/cveNotify/163094 · Telegram Post