Arbitrary File Overwrite Vulnerability in DDEV Tool by Drud Technology
CVE-2026-108262

6.5MEDIUM

Key Information:

Vendor

Ddev

Status
Ddev
Vendor
CVE Published:
6 November 2026

What is CVE-2026-108262?

DDEV, a popular open-source tool geared towards local web development for PHP and Node.js, has a significant vulnerability that affects versions 1.25.2 through 1.25.4. The issue arises from the Untar function in pkg/archive/archive.go, where the validation of an absolute tar symlink target is flawed. This permits crafted archives to create a host-absolute symlink, allowing malicious entities to bypass directory restrictions. By executing remote add-on retrieval and database or file imports, attackers could overwrite critical system files, including shell startup files, Git hooks, or cron entries, potentially leading to unauthorized code execution within the DDEV user's environment. This vulnerability has been addressed in version 1.25.4.

Affected Version(s)

ddev >= 1.25.2, < 1.25.4

References

https://github.com/ddev/ddev/security/advisories/GHSA-9hq...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.