Executive brief
DDEV is an open-source tool used by developers to run local web development environments. A security flaw in how the tool handles downloaded archives could allow a malicious file to overwrite critical system files on a developer's computer. This occurs when DDEV downloads and extracts add-ons or updates from untrusted remote sources, potentially leading to unauthorized system modifications.
Technical details
A path traversal vulnerability (ZipSlip) exists in DDEV's `Untar()` and `Unzip()` functions within `pkg/archive/archive.go`. The functions use `filepath.Join()` to combine a destination directory with filenames from an archive without validating that the resulting path remains within the intended destination. An attacker can craft a malicious tar or zip archive containing filenames with traversal sequences (e.g., `../../`). When a user downloads and extracts such an archive—typically through DDEV's add-on or update mechanisms—the tool will write files to arbitrary locations on the local filesystem. This issue is patched in version 1.25.2.
Affected products
- DDEV DDEV < 1.25.2
Timeline
- 2026-04-22: disclosed
- 2026-04-22: patched: Fixed in version 1.25.2
- 2026-04-22: advisory