Approved changes feed: RSS · Atom
cpe:2.3:a:ddev:ddev:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Ddev (ae88d111-3a7c-533c-a514-418d01fac190) |
|---|---|
| Product | Ddev (4bdc118c-7a9a-5214-a495-7104795ccb85) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ddev/ddev |
purl2cpe | 2026-06-01 10:16:20.039244 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-32885 |
vulnerable | 2026-06-08 07:57:18.290959 |
DDEV has ZipSlip path traversal in tar and zip archive extraction
MEDIUM (6.5)
DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue.
Published: 2026-04-22T16:54:47.880Z
Updated: 2026-04-22T18:35:36.170Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.