CVE-2026-32885: Ddev

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.

Affected products

• Ddev Ddev: before 1.25.2 (fixed in 1.25.2)

Published 2026-04-22. Last modified 2026-06-17.