- Severity: HIGH
- CVE: CVE-2026-108262
- Ecosystems: go
- Packages: github.com/ddev/ddev
## Summary
The CVE-2026-32885 ZipSlip fix added a symlink-target escape check to Untar, but the check rebases an ABSOLUTE symlink target into dest before validating (filepath.Join(dest, “/etc”) stays lexically inside dest and passes), while the symlink is then created with the RAW absolute target via os.Symlink(file.Linkname, …), so a malicious archive plants a host-absolute symlink and a following regular-file entry writes through it, restoring arbitrary host file create/overwrite (reaching $HOME rc-files, hence RCE). Confirmed at HEAD.
## The defect (the symlink check is a no-op for absolute targets)
CVE-2026-32885 (fixed v1.25.2, commit 05cbe299) added a lexical containment check on the entry path and a NEW symlink-target validation. pkg/archive/archive.go, Untar, tar.TypeSymlink case:
“`go
if filepath.IsAbs(file.Linkname) {
resolvedTarget = filepath.Join(dest, file.Linkname) // line 298: absolute target REBASED into dest
} else {
resolvedTarget = filepath.Join(fullPathDir, file.Linkname)
}
if !strings.HasPrefix(filepath.Clean(resolvedTarget)+sep, filepath.Clean(dest)+sep) { // line 302
return …escapes destination… // line 303
}
_ = os.Remove(fullPath) // line 307
err = os.Symlink(file.Linkname, fullPath) // line 310: writes the RAW Linkname
“`
For an absolute Linkname like /Users/victim, line 298 computes filepath.Join(dest, “/Users/victim”) = dest/Users/victim (lexically inside dest), so the escape check at line 302 PASSES. But line 310 creates the symlin…
Source: GitHub Security Advisories · 2026-11-09