DDEV contains a path traversal flaw in its Untar() and Unzip() functions when handling archives downloaded from remote sources. The extractor does not validate paths, enabling an attacker who controls the archive to write files to arbitrary locations on the host. By embedding malicious payloads within such an archive, an attacker could achieve remote code execution, consistent with CWE-22.

The vulnerability affects the open‑source DDEV tool used for local PHP and Node.js development environments. All releases prior to version 1.25.2 are susceptible. The 1.25.2 release and later include a patch that sanitises archive extraction.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a local or remote attacker who can supply a crafted archive; once the archive is downloaded, the extraction routine will write potentially harmful files. No publicly reported exploits exist yet, but the lack of path validation poses a notable risk.