DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.

Affected: Go: github.com/ddev/ddev

## Summary

The DDEV local dev tool has unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. This flaw allows users to download and extract archives from remote sources without path validation.

## Vulnerable Code

`pkg/archive/archive.go:235` (Untar): ```go fullPath := filepath.Join(dest, file.Name) // NO SANITIZATION ```

`pkg/archive/archive.go:342` (Unzip): ```go fullPath := filepath.Join(dest, file.Name) // NO SANITIZATION ```

Both functions create directories via `os.MkdirAll` and files via `os.Create` using the unsanitized path.

## Impact

Local development tool that downloads and extracts archives from remote sources (add-ons, updates). Malicious archive → arbitrary file write on developer machine.

## Proof of Concept

```go package main

// PoC: ddev/ddev CWE-22 — ZipSlip in tar archive extraction // Replicates the exact pattern from pkg/archive/archive.go:235 (Untar) // and pkg/archive/archive.go:342 (Unzip) — both use filepath.Join(dest, name) // without verifying the result stays under the destination directory.

import ( "archive/tar" "bytes" "fmt" "io" "os" "path/filepath" )

// Vulnerable extraction — mirrors pkg/archive/archive.go:235 func untarVulnerable(dst string, r io.Reader) error { tr := tar.NewReader(r) for { header, err := tr.Next() if err == io.EOF { break } if err != nil { return err } // VULNERABLE: identical to archive.go:235 // fullPath := filepath.Join(dest, file.Name) f…