CVE-2026-32885

CVE-2026-32885 is a path traversal vulnerability affecting DDEV, an open-source local web development tool for PHP and Node.js, in versions prior to 1.25.2. The vulnerability stems from unsanitized extraction functions (Untar() and Unzip()) in pkg/archive/archive.go that fail to validate file paths when downloading and extracting remote archives, potentially allowing malicious archives to write files outside their intended directories. The vulnerability carries a CVSS v3.1 score of 6.5 (MEDIUM severity) with a network-based attack vector requiring minimal complexity and user interaction. While the attack does not compromise confidentiality or availability, it poses a significant integrity risk, as attackers could inject or overwrite files on affected systems through specially crafted archive files. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and it remains on the inactive Hot List. The EPSS score of 0.000120000 indicates relatively low probability of exploitation compared to the broader CVE landscape. Users should upgrade to version 1.25.2 or later to remediate this risk.