#+HashtagPLUS#Hashtag the Web... #Tag your World!
Join

Menu

New post
CVE-2026-108262: CVE-2026-108262: Arbitrary Host File Overwrite via Tar Symlink Traversal in DDEV
📰

CVE-2026-108262: CVE-2026-108262: Arbitrary Host File Overwrite via Tar Symlink Traversal in DDEV

DEV Community: cybersecurity·CVE Reports·about 16 hours ago
#KpAdQchR
#devtocybersecurity#devto#dev#ddev#archive
Reading 0:00
15s threshold

CVE-2026-108262: Arbitrary Host File Overwrite via Tar Symlink Traversal in DDEV

Vulnerability ID: CVE-2026-108262

CVSS Score: 6.5

Published: 2026-11-09

CVE-2026-108262 (GHSA-9hq4-hm3j-jmph) is a path traversal and arbitrary file overwrite vulnerability in the tar archive extraction routine of DDEV versions 1.25.2 and 1.25.3. Resulting from an incomplete fix for CVE-2026-32885, the Untar function in pkg/archive/archive.go validates absolute symbolic link targets by rebasing them against the extraction destination directory, but subsequently creates the symbolic link on disk using the raw, unvalidated absolute path.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Create free accountLog in