What is the CVSS score of CVE-2026-32885?

CVE-2026-32885 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-32885?

Yes, a patch is available for CVE-2026-32885. Update the affected software to the latest version immediately.

DDEV CVE-2026-32885

EUVD-2026-25049 MEDIUM

Path Traversal (CWE-22)

2026-04-22 security-advisories@github.com

GHSA-x2xq-qhjf-5mvg

Node.js PHP Path Traversal

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 23, 2026 - 07:06 vuln.today

Patch released

Apr 22, 2026 - 21:23 nvd

Patch available

Apr 22, 2026 - 19:03 EUVD

EUVD ID Assigned

Apr 22, 2026 - 17:22 euvd

EUVD-2026-25049

Analysis Generated

Apr 22, 2026 - 17:22 vuln.today

CVE Published

Apr 22, 2026 - 17:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both Untar() and Unzip() functions in pkg/archive/archive.go. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.

AnalysisAI

Path traversal in DDEV versions prior to 1.25.2 allows remote attackers to write files outside intended extraction directories when downloading and extracting archives from remote sources. The vulnerability affects the Untar() and Unzip() functions in pkg/archive/archive.go, which lack path validation during extraction. Exploitation requires user interaction (UI:R) to trigger archive extraction but can achieve high integrity impact through arbitrary file write. A proof-of-concept exists, and CISA SSVC framework rates this as exploitable with partial technical impact.

Technical ContextAI

DDEV is a containerized local development environment tool supporting PHP and Node.js projects. The vulnerability exists in the archive extraction library (pkg/archive/archive.go) which handles both TAR and ZIP formats. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates the root cause: extraction functions fail to sanitize or validate file paths before writing to disk. When processing archive entries, path traversal sequences such as '../' or absolute paths are not stripped or rejected, allowing malicious archives to extract files to arbitrary filesystem locations. This is a classic zip-slip vulnerability pattern affecting both compressed formats simultaneously, with the CVSS vector showing network-accessible attack surface but requiring user interaction to initiate the extraction process.

RemediationAI

Upgrade DDEV to version 1.25.2 or later immediately. The vendor has released a patched version (1.25.2) available from the official GitHub releases page at https://github.com/ddev/ddev/releases/tag/v1.25.2. For users unable to upgrade immediately, minimize risk by avoiding extraction of archives from untrusted sources and disabling automatic archive downloads if such functionality exists in your workflow. Run DDEV in isolated development environments rather than shared or production systems to limit the blast radius of potential file writes. Code review of PR #8213 (https://github.com/ddev/ddev/pull/8213) documents the path sanitization fixes applied and can guide manual review of custom archive handling code if present in your environment. There are no documented workarounds beyond upgrading; the core vulnerability cannot be mitigated without fixing the extraction functions themselves.