6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32885

CVE-2026-32885: DDEV has ZipSlip path traversal in tar and zip archive extraction

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both Untar() and Unzip() functions in pkg/archive/archive.go. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32885

CVE-2026-32885:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ddev/ddev	go	< 1.25.2	1.25.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis is based on the provided security advisory and the associated patch in commit 05cbe299770a590b89bfc8dddab33e61b4302e43. The commit clearly shows modifications to two functions, Untar and Unzip, in the file pkg/archive/archive.go. Both functions were identified as vulnerable to a "ZipSlip" path traversal attack. The vulnerability lies in the fact that the file paths from the archives were being joined with the destination path without validation. This allowed for file names containing '..' to traverse up the directory tree and write files to arbitrary locations on the file system. The patch mitigates this by adding a crucial check to verify that the resolved path of the file to be extracted is still within the intended destination directory. Therefore, both Untar and Unzip are the vulnerable functions where the exploitation would occur.

Vulnerable functions

Untar

pkg/archive/archive.go

The 'Untar' function is vulnerable to path traversal. It constructs a file path by joining the destination directory with a file name from the tar archive without proper sanitization. A malicious actor could craft a tar archive with a file name like '../../../../tmp/pwned' to write files outside the intended destination directory. The patch added a check to ensure the extracted file path is within the destination directory.

Unzip

pkg/archive/archive.go

The 'Unzip' function is vulnerable to path traversal. It constructs a file path by joining the destination directory with a file name from the zip archive without proper sanitization. A malicious actor could craft a zip archive with a file name like '../../../../tmp/pwned' to write files outside the intended destination directory. The patch added a check to ensure the extracted file path is within the destination directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.