DebugKit: MailPreview contains unsafe reflection
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cakephp | debug_kit | before 4.10.3; 5.0.0 to before 5.2.4 | 4.10.3, 5.2.4 | Patch available | CNA |
| — | cakephp/debug_kit (Packagist) | before 4.10.3 | 4.10.3 | Patch available | GHSA-p46m-g734-vpc4 |
| — | cakephp/debug_kit (Packagist) | 5.0.0 to before 5.2.4 | 5.2.4 | Patch available | GHSA-p46m-g734-vpc4 |
- debug_kit Vendorcakephp Affected before 4.10.3; 5.0.0 to before 5.2.4 Fixed in 4.10.3, 5.2.4 Patch available CNA
- cakephp/debug_kit (Packagist) Vendor— Affected before 4.10.3 Fixed in 4.10.3 Patch available GHSA-p46m-g734-vpc4
- cakephp/debug_kit (Packagist) Vendor— Affected 5.0.0 to before 5.2.4 Fixed in 5.2.4 Patch available GHSA-p46m-g734-vpc4
Remediation
- Fix · CNA debug_kit (cakephp) Fixed in 4.10.3, 5.2.4
- Fix · GHSA-p46m-g734-vpc4 cakephp/debug_kit (Packagist) Fixed in 4.10.3 Advisory →
- Fix · GHSA-p46m-g734-vpc4 cakephp/debug_kit (Packagist) Fixed in 5.2.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54614
- 2026-10-03 Alias added: GHSA-p46m-g734-vpc4
References
Other 7
- https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
- https://github.com/cakephp/debug_kit/pull/1078
- https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13
- https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
- https://github.com/cakephp/debug_kit/releases/tag/4.10.3
- https://github.com/cakephp/debug_kit/releases/tag/5.2.4
- https://github.com/cakephp/debug_kit
More cakephp vulnerabilities
- TI-2010-04068 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… CVSS 2.0HIGH 7.5
- TI-2026-82995 Cookie leakage in CakePHP HTTP client cookie domain matching CVSS 4.0MEDIUM 6.3
- TI-2026-19037 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVSS 3.1MEDIUM 5.4
- TI-2023-08901 Database Query::offset() and limit() vulnerable to SQL injection in cakephp CVSS 3.1CRITICAL 9.8
- TI-2026-54106 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CVSS 4.0CRITICAL 9.2
- TI-2026-55232 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CVSS 4.0CRITICAL 9.2
Sources
- CVE-2026-54614 · CVE Program
- CVE-2026-54614 · NVD
- FIRST EPSS
- GHSA-p46m-g734-vpc4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences