CVE-2026-32885 is a medium severity path traversal in DDEV, the local development environment tool, scored CVSS 6.5. Its Untar and Unzip functions extracted downloaded archives without checking file paths. Versions before 1.25.2 are affected, so upgrade and install add-ons only from sources you trust.
What's affected
The NVD record and the GitHub advisory agree. DDEV versions before 1.25.2 are affected, and 1.25.2 patches the issue. The advisory lists the Go module github.com/ddev/ddev.
The functions are Untar() and Unzip() in pkg/archive/archive.go. The advisory says DDEV downloads and extracts archives from remote sources such as add-ons and updates, and that a malicious archive could write files to the developer's machine.
How to check if you're exposed
Check your DDEV version:
ddev version
Compare it with 1.25.2. To update, use your install method. The release notes say on macOS you can run brew upgrade ddev, on Linux you update through apt or yum, and on Windows you rerun the installer.
Then look at which add-ons and archive sources your projects pull:
ddev add-on list --installed
What to do now
- Upgrade DDEV to 1.25.2 or later.
- Install add-ons only from sources you trust, and review third party ones before use.
- Do not run DDEV commands as an administrator or root user.
- Keep sensitive files such as SSH keys and shell profiles out of reach of tools you do not need to trust fully.
- Update your project configuration afterwards with the ddev config command and its auto option, as the release notes suggest.
Why it matters
The class is CWE-22, path traversal, in the form known as zip slip. When code joins an extraction folder with a file name taken from the archive, a name with directory steps can land anywhere the user can write.
For a developer machine, arbitrary file write can mean changes to shell startup files or keys. The score is medium because the archive has to come from a source the attacker influences. Still, developer tools sit close to credentials, so supply chain minded teams update them as quickly as servers. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this only a risk with untrusted add-ons?
The advisory describes archives from remote sources such as add-ons and updates. Trusting the source reduces the risk, and the upgrade removes it.
Sources
Last reviewed: 19 October 2026.
