{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3addevddev/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ddev:ddev:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-108262"},{"cvss":6.5,"id":"CVE-2026-32885"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ddev (\u003c 1.25.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["DDEV"],"content_html":"\u003cp\u003eDDEV versions prior to 1.25.4 contain an incomplete fix for symlink traversal vulnerabilities. The application performs lexical validation on absolute symlink targets by rebasing them within a destination directory, but subsequently writes the raw, absolute target to the filesystem using \u003ccode\u003eos.Symlink\u003c/code\u003e. This discrepancy allows an attacker to plant a symlink pointing to an arbitrary host location. A subsequent file entry in the same archive can then traverse this symlink to overwrite sensitive files outside the intended extraction path. Successful exploitation targeting shell rc-files, git hooks, or cron jobs can result in arbitrary code execution. This vulnerability is reachable via \u003ccode\u003eddev add-on get\u003c/code\u003e, \u003ccode\u003eddev import-db\u003c/code\u003e, and \u003ccode\u003eddev import-files\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious tar archive containing an absolute symlink entry (e.g., pointing to \u003ccode\u003e/home/user/.zshrc\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker includes a second regular-file entry in the archive with a path that traverses the planted symlink.\u003c/li\u003e\n\u003cli\u003eDDEV \u003ccode\u003eUntar\u003c/code\u003e function processes the symlink; the lexical check passes because it rebases the path, but the file is created with the raw absolute target.\u003c/li\u003e\n\u003cli\u003eThe malicious symlink is created on the host filesystem pointing to a sensitive file.\u003c/li\u003e\n\u003cli\u003eDDEV \u003ccode\u003eUntar\u003c/code\u003e processes the subsequent file entry, which passes the lexical check as it appears to be inside the destination.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eos.Create\u003c/code\u003e follows the symlink and overwrites the target sensitive file on the host.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExploitation results in the ability to overwrite arbitrary files on the host filesystem with the privileges of the user running DDEV. By targeting shell configuration files, git hooks, or automation scripts, an attacker can achieve persistent code execution on the host machine.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade DDEV to version 1.25.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eUntil patched, avoid executing \u003ccode\u003eddev\u003c/code\u003e commands against untrusted or externally sourced archives, repositories, or add-ons.\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring on sensitive user directories (e.g., \u003ccode\u003e$HOME/.ssh\u003c/code\u003e, \u003ccode\u003e$HOME/.zshrc\u003c/code\u003e, \u003ccode\u003e$HOME/.bashrc\u003c/code\u003e, \u003ccode\u003egit\u003c/code\u003e hooks) to detect unauthorized file modifications occurring during DDEV operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T16:37:50Z","date_published":"2026-11-10T16:37:50Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ddev-symlink-traversal/","summary":"An incomplete fix for CVE-2026-32885 in DDEV allows attackers to perform arbitrary host file overwrites and achieve code execution by planting absolute symlinks via maliciously crafted tar archives.","title":"DDEV: Incomplete symlink traversal fix allows arbitrary host file overwrite (CVE-2026-108262)","url":"https://feed.craftedsignal.io/briefs/2026-11-ddev-symlink-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ddev:ddev:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}