CVE-2026-32885 DDEV has ZipSlip path traversal in tar and zip archive extraction
Attackers can exploit unsanitized archive extraction in DDEV to write files outside intended directories, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32885?
CVE-2026-32885 is a medium-severity path traversal vulnerability in ddev, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-32885?
3 open source packages ship an affected version, including github.com/ddev/ddev. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ddev/ddev Go | All versions | 1.25.2 |
github.com/ddev/ddev Go | All versions | 1.25.2 |
github.com/ddev/ddev Go | All versions | 1.25.2 |
Products include Ddev Ddev.
How do I fix CVE-2026-32885?
Upgrade github.com/ddev/ddev to 1.25.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-32885 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32885 exists.
Sources
Also known as GHSA-x2xq-qhjf-5mvg, GO-2026-5735.