PT-2026-34524 · Ddev · Ddev

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-32885

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DDEV versions prior to 1.25.2

Description DDEV is an open-source tool for running local web development environments for PHP and Node.js. The software performs unsanitized extraction of archives from remote sources without path validation within the Untar() and Unzip() functions located in pkg/archive/archive.go.

Recommendations Update to version 1.25.2.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32885

Affected Products

Ddev

References · 4

• 🔥 https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf-5mvg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32885 · Security Note
• https://twitter.com/CVEnew/status/2047012067471921206 · Twitter Post
• https://github.com/ddev/ddev/releases/tag/v1.25.2 · Note