CVE-2026-54614
Published:August 26, 2026
Updated:September 24, 2026
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.
Affected Packages
https://github.com/cakephp/debug_kit.git (GITHUB):
Affected version(s) >=3.11.6 <4.10.3Fix Suggestion:
Update to version 4.10.3https://github.com/cakephp/debug_kit.git (GITHUB):
Affected version(s) >=5.0.0 <5.2.4Fix Suggestion:
Update to version 5.2.4cakephp/debug_kit (PHP):
Affected version(s) >=5.0.0 <5.2.4Fix Suggestion:
Update to version 5.2.4cakephp/debug_kit (PHP):
Affected version(s) >=dev-add-security-policy <4.10.3Fix Suggestion:
Update to version 4.10.3Related Resources (9)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
EPSS
Base Score:
0.31