Threats tagged 'ghsa-9hq4-hm3j-jmph'

A vulnerability in the Untar function of github.com/ddev/ddev prior to version 1.25.4 allows an attacker to overwrite arbitrary host files via crafted tar archives containing absolute symlink targets. The flaw arises because the symlink target validation rebases absolute paths into the extraction directory for checking but creates symlinks using the raw absolute target, enabling escape from the intended extraction directory. This can lead to overwriting critical files such as shell rc-files, potentially resulting in remote code execution.