cakephp/debug_kit · Security
cakephp/debug_kit: MailPreview contains unsafe reflection
- GHSA ID
- GHSA-p46m-g734-vpc4
- CVE ID
- CVE-2026-54614
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Impact
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
debugmode must be enabled.- The hostname must match a 'local' domain or be in an allowlist.
Patches
5.2.4 and 4.10.3 contain patches for this issue.
Workarounds
Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
CWEs
- CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
References
- https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4 ↗
- https://github.com/cakephp/debug_kit/pull/1078 ↗
- https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13 ↗
- https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6 ↗
- https://github.com/cakephp/debug_kit/releases/tag/4.10.3 ↗
- https://github.com/cakephp/debug_kit/releases/tag/5.2.4 ↗
- https://github.com/advisories/GHSA-p46m-g734-vpc4 ↗