DDEV’s untar routine validates an absolute symlink target after rebasing it beneath the destination directory, but writes the symlink with the raw absolute Linkname. A malicious archive can therefore create a host‑absolute symlink that follows to arbitrary files, and a subsequent file entry can overwrite those files. This flaw allows an attacker to overwrite shell startup files, Git hooks, or cron entries, leading to code execution. The weakness is based on improper path validation (CWE‑22) and hard‑coded absolute paths (CWE‑59).

The issue affects the open‑source DDEV tool used for local PHP and Node.js web development. Versions 1.25.2 through 1.25.4 of ddev are vulnerable; the fix was released in version 1.25.4. Users operating older or nearly-fix versions are at risk.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be reached through remote add‑on retrieval and database or file imports, both of which accept external archives that can be crafted to include the symlink exploit. An attacker who can supply or influence the archive content can overwrite privileged files and execute code in the context of the DDEV user. The exploit requires local or remote access to the import or add‑on functionality but otherwise no additional privileges are necessary.