Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-23 | 1 | General1 |
| 2026-04-22 | 1 | Disclosure1 |
CVE-2026-32885 DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()`… https://www.cve.org/CVERecord?id=CVE-2026-32885
Post summary
The CVE points to an unsanitized extraction flaw in DDEV’s Untar function affecting versions before 1.25.2, with no details of exploitation, PoC, or patch provided.
CVE-2026-32885 CVE-2026-32885 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32885 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The text merely announces CVE-2026-32885 and provides a link to a vulnerability details page, without additional technical or operational context.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ddev | ddev | - | - | - |