Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: ddev

Found 1 matching suggestions

View:
Compact
Detailed
Published
Permalink CVE-2026-32885
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
updated 6 days, 11 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 17 hours ago
  • @LeSuisse ignored
    5 packages
    • vdrPlugins.softhddevice
    • python312Packages.sounddevice
    • python313Packages.sounddevice
    • python314Packages.sounddevice
    • haskellPackages.gogol-androiddeviceprovisioning
    6 days, 11 hours ago
  • @LeSuisse accepted 6 days, 11 hours ago
  • @LeSuisse published on GitHub 6 days, 11 hours ago
DDEV has ZipSlip path traversal in tar and zip archive extraction

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.

References

Ignored references (1)

Affected products

ddev
  • ==< 1.25.2

Matching in nixpkgs

pkgs.ddev

Docker-based local PHP+Node.js web development environments

Ignored packages (5)

Package maintainers