DDEV has ZipSlip path traversal in tar and zip archive extraction
Date: 2026-04
Affected: go/github.com/ddev/ddev
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-32885
CWE: CWE-22
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

## Summary The DDEV local dev tool has unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. This flaw allows users to download and extract archives from remote sources without path validation. ## Vulnerable Code `pkg/archive/archive.go:235` (Untar): ```go fullPath := filepath.Join(dest, file.Name) // NO SANITIZATION ``` `pkg/archive/archive.go:342` (Unzip): ```go fullPath := filepath.Join(dest, file.Name) // NO SANITIZATION ``` Both functions create directories via `os.MkdirAll` and files via `os.Create` using the unsanitized path. ## Impact Local development tool that downloads and extracts archives from remote sources (add-ons, updates). Malicious archive → arbitrary file write on developer machine. ## Proof of Concept ```go package main // PoC: ddev/ddev CWE-22 — ZipSlip in tar archive extraction // Replicates the exact pattern from pkg/archive/archive.go:235 (Untar) // and pkg/archive/archive.go:342 (Unzip) — both use filepath.Join(dest, name) // without verifying the result stays under the destination directory. import ( "archive/tar" "bytes" "fmt" "io" "os" "path/filepath" ) // Vulnerable extraction — mirrors pkg/archive/archive.go:235 func untarVulnerable(dst string, r io.Reader) error { tr := tar.NewReader(r) for { header, err := tr.Next() if err == io.EOF { break } if err != nil { return err } // VULNERABLE: identical to archive.go:235 // fullPath := filepath.Join(dest, file.Name) fu


Mitigations:

Architectural layers (MAESTRO):