Read the docs
TI-2026-86064 Aliases CVE-2026-108262

DDEV incomplete tar symlink traversal fix allows host file overwrite

Priority LOW 29CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

DDEV, an open-source tool for local PHP and Node.js web development environments, is affected from 1.25.2 before 1.25.4. An earlier fix for path traversal in tar extraction validates absolute symlink targets but creates the symlink with the raw absolute target, so a crafted archive can plant a host-absolute symlink, and a following regular-file entry can write outside the extraction directory (CWE-59, CWE-22). The flaw is reachable through remote add-on retrieval and database or file imports. Overwriting shell startup files, Git hooks or cron entries can lead to code execution as the DDEV user, and a victim must import or retrieve the crafted archive.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted archive can therefore plant a host-absolute symlink and use a following regular-file entry to write outside the extraction directory. The flaw is reachable through remote add-on retrieval and database or file imports, and overwriting shell startup files, Git hooks, or cron entries can lead to code execution in the DDEV user's context. Unzip is not affected. This issue is fixed in version 1.25.4.

Why it matters now

EPSS 0.00306 23rd percentileScored 2026-11-07
Fix Fixed ddev (ddev): 1.25.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ddevddev1.25.2 to before 1.25.41.25.4Patch availableCNA
  • ddev Vendorddev Affected 1.25.2 to before 1.25.4 Fixed in 1.25.4 Patch available CNA

Remediation

Update DDEV to version 1.25.4, which fixes this issue. Unzip is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ddev (ddev) Fixed in 1.25.4

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-108262
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-25344 DDEV has ZipSlip path traversal in tar and zip archive extraction CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences