https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T02:27:25.752565+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-32885 CVE-2026-32885 — DDEV has ZipSlip path traversal in tar and zip archive extraction 2026-10-18T02:27:25.754197+00:00

Affected: ddev

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.