PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32885 Ddev CVE debrief

CVE-2026-32885 is a DDEV archive-extraction vulnerability affecting versions prior to 1.25.2. The issue is in the Untar() and Unzip() code paths, which extracted remote archives without validating paths first. That creates a path traversal risk and can let crafted archive contents write outside the intended extraction directory. DDEV 1.25.2 is the fixed release.

Vendor
Ddev
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-05-11
Advisory published
2026-04-22
Advisory updated
2026-05-11

Who should care

DDEV users on versions prior to 1.25.2, especially developers, platform engineers, and CI/CD or automation workflows that download or extract archives from remote or user-influenced sources.

Technical summary

The NVD record describes a CWE-22 path traversal issue in pkg/archive/archive.go affecting both Untar() and Unzip(). Because archive extraction occurred without path validation, malicious archive entries could escape the intended destination during extraction. The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network reachability, low attack complexity, no privileges required, and a user interaction requirement.

Defensive priority

Medium; prioritize upgrading promptly if DDEV is used to fetch or extract archives from untrusted, remote, or user-controlled sources.

Recommended defensive actions

  • Upgrade DDEV to version 1.25.2 or later.
  • Review any workflows that download and extract archives through DDEV and confirm the archive sources are trusted.
  • Check local development and automation environments for unexpected file changes after archive extraction.
  • If immediate upgrading is not possible, minimize use of the affected archive paths and restrict archive sources to known-good inputs.
  • Monitor vendor release notes and the security advisory for any follow-on guidance.

Evidence notes

The official NVD entry states that DDEV versions prior to 1.25.2 are vulnerable and identifies CWE-22 with CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). The GitHub security advisory GHSA-x2xq-qhjf-5mvg and the v1.25.2 release tag both point to the fix in DDEV 1.25.2 and provide mitigation context. No KEV entry was supplied in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32885 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32885

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32885 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32885

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.