CVE-2026-108262: Arbitrary Host File Overwrite via Tar Symlink Traversal in DDEV

Vulnerability ID: CVE-2026-108262
CVSS Score: 6.5
Published: 2026-11-09

CVE-2026-108262 (GHSA-9hq4-hm3j-jmph) is a path traversal and arbitrary file overwrite vulnerability in the tar archive extraction routine of DDEV versions 1.25.2 and 1.25.3. Resulting from an incomplete fix for CVE-2026-32885, the Untar function in pkg/archive/archive.go validates absolute symbolic link targets by rebasing them against the extraction destination directory, but subsequently creates the symbolic link on disk using the raw, unvalidated absolute path. When subsequent entries in the archive write through the planted symbolic link, the host operating system resolves the link directly to the host filesystem, allowing an attacker to overwrite arbitrary files with the privileges of the user executing DDEV.

TL;DR

An incomplete fix for CVE-2026-32885 in DDEV versions 1.25.2 and 1.25.3 allows malicious tar archives containing absolute symlink targets to bypass extraction directory containment, resulting in arbitrary file overwrite on the host filesystem.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: Path Traversal / Arbitrary File Overwrite (CWE-22, CWE-59)
Affected Component: pkg/archive/archive.go (Untar function)
Affected Versions: DDEV >= 1.25.2, < 1.25.4 (v1.25.2, v1.25.3)
CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
EPSS Score: 0.31% (23.60th Percentile)
Exploit Status: Proof-of-Concept Available (Unit Test in Patch)
CISA KEV Status: Not Listed
Patched Version: DDEV 1.25.4

Affected Systems

DDEV (ddev/ddev)
ddev: >= 1.25.2, < 1.25.4 (Fixed in: 1.25.4)

Code Analysis

Commit: 7034963

Reject absolute symlink targets in Untar via isArchiveAbsolutePath() to prevent symlink write-through path traversal (GHSA-9hq4-hm3j-jmph).

--- a/pkg/archive/archive.go +++ b/pkg/archive/archive.go @@ -154,6 +154,19 @@ func UnXz(source string, destDirectory string) error { return nil } +func isArchiveAbsolutePath(p string) bool { + return strings.HasPrefix(p, "/") || strings.HasPrefix(p, `\`) || filepath.IsAbs(p) +} + // Untar accepts a tar, tar.gz, tar.bz2, tar.xz file and extracts the contents to the provided destination path. @@ -289,24 +302,24 @@ func Untar(source string, dest string, extractionDir string) error { return fmt.Errorf("failed to create the directory %s, err: %v", fullPathDir, err) } - var resolvedTarget string - if filepath.IsAbs(file.Linkname) { - resolvedTarget = filepath.Join(dest, file.Linkname) - } else { - resolvedTarget = filepath.Join(fullPathDir, file.Linkname) + if isArchiveAbsolutePath(file.Linkname) { + return fmt.Errorf("symlink target %q in archive entry %q is absolute, which is not allowed", file.Linkname, file.Name) } + resolvedTarget := filepath.Join(fullPathDir, file.Linkname) if !strings.HasPrefix(filepath.Clean(resolvedTarget)+string(os.PathSeparator), filepath.Clean(dest)+string(os.PathSeparator)) { return fmt.Errorf("symlink target %q in archive entry %q escapes destination directory", file.Linkname, file.Name) } // Remove any existing file/symlink at this path _ = os.Remove(fullPath) - // Create the symlink err = os.Symlink(file.Linkname, fullPath) if err != nil { return fmt.Errorf("failed to create symlink %v -> %v, err: %v", fullPath, file.Linkname, err)

Exploit Details

GitHub: Official regression test (absolute_symlink_write_through_escape) demonstrating arbitrary file overwrite via tar symlink traversal in pkg/archive/archive_test.go.

Mitigation Strategies

Upgrade DDEV to version 1.25.4 or higher to enforce strict rejection of absolute symlink targets during tar extraction.
Restrict the use of 'ddev get', 'ddev import-db', and 'ddev import-files' to trusted, cryptographically verified archives.
Pre-screen external tar archives in CI/CD pipelines or developer workflows for symbolic link entries containing leading slashes or drive letters.

Remediation Steps:

Check the currently installed DDEV version by executing 'ddev --version'.
If running version 1.25.2 or 1.25.3, upgrade DDEV to version 1.25.4 or later via your system package manager or the official DDEV release binaries.
Audit local developer environments for unexpected modifications to shell startup scripts (~/.bashrc, ~/.zshrc) or ~/.ssh/authorized_keys if untrusted archives were recently imported.