DDEV: Incomplete symlink traversal fix allows arbitrary host file overwrite (CVE-2026-108262)

DDEV versions prior to 1.25.4 contain an incomplete fix for symlink traversal vulnerabilities. The application performs lexical validation on absolute symlink targets by rebasing them within a destination directory, but subsequently writes the raw, absolute target to the filesystem using os.Symlink. This discrepancy allows an attacker to plant a symlink pointing to an arbitrary host location. A subsequent file entry in the same archive can then traverse this symlink to overwrite sensitive files outside the intended extraction path. Successful exploitation targeting shell rc-files, git hooks, or cron jobs can result in arbitrary code execution. This vulnerability is reachable via ddev add-on get, ddev import-db, and ddev import-files.

Attack Chain

1. Attacker crafts a malicious tar archive containing an absolute symlink entry (e.g., pointing to /home/user/.zshrc).
2. Attacker includes a second regular-file entry in the archive with a path that traverses the planted symlink.
3. DDEV Untar function processes the symlink; the lexical check passes because it rebases the path, but the file is created with the raw absolute target.
4. The malicious symlink is created on the host filesystem pointing to a sensitive file.
5. DDEV Untar processes the subsequent file entry, which passes the lexical check as it appears to be inside the destination.
6. os.Create follows the symlink and overwrites the target sensitive file on the host.

Impact

Exploitation results in the ability to overwrite arbitrary files on the host filesystem with the privileges of the user running DDEV. By targeting shell configuration files, git hooks, or automation scripts, an attacker can achieve persistent code execution on the host machine.

Recommendation

• Upgrade DDEV to version 1.25.4 or later immediately.
• Until patched, avoid executing ddev commands against untrusted or externally sourced archives, repositories, or add-ons.
• Implement file integrity monitoring on sensitive user directories (e.g., $HOME/.ssh, $HOME/.zshrc, $HOME/.bashrc, git hooks) to detect unauthorized file modifications occurring during DDEV operations.