CVE-2026-54614
DebugKit: MailPreview contains unsafe reflection
- State
- Published
- Severity
- 4.3 Medium
- Published
- Aug 26, 2026
- Updated
- Aug 29, 2026
- Reserved
- Jun 15, 2026
Description
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | GitHub_M |
Weaknesses
- CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected Products
| Product | Versions |
|---|---|
debug_kitcakephp |
|
References
- https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
- https://github.com/cakephp/debug_kit/pull/1078
- https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13
- https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
- https://github.com/cakephp/debug_kit/releases/tag/4.10.3
- https://github.com/cakephp/debug_kit/releases/tag/5.2.4
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.