Cyber Resilience

CVE-2026-32885

MediumPublic PoC

Published: 22 April 2026

Published
22 April 2026
Modified
11 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score 0.0042 33.4th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-32885 is a medium-severity Path Traversal (CWE-22) vulnerability in Ddev Ddev. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation.…

more

Version 1.25.2 patches the issue.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

Affected Assets

ddev
ddev
≤ 1.25.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References