Vendor
An incomplete fix for CVE-2026-32885 in DDEV allows attackers to perform arbitrary host file overwrites and achieve code execution by planting absolute symlinks via maliciously crafted tar archives.