Skip to content
OpenAdvisories

Vendor

ddev

2 known vulnerabilities.

Products

ddev 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-108262

    DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885

    DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the…

    ddev ddev github.com/ddev/ddev Go
  • Medium 6.5
    CVE-2026-32885

    DDEV has ZipSlip path traversal in tar and zip archive extraction

    DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from re…

    ddev ddev github.com/ddev/ddev Go