GitHub Advisoryadvisory · Packagist
GHSA-p46m-g734-vpc4 cakephp/debug_kit: MailPreview contains unsafe reflection
MEDIUM
Official page ↗
- Aliases
- CVE-2026-54614
- Ecosystem
- Packagist
- Packages
- cakephp/debug_kit
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-470
- Reviewed
- 2026-08-26
Affected packages
• Packagist cakephp/debug_kit: < 4.10.3 → fixed in 4.10.3
• Packagist cakephp/debug_kit: >= 5.0.0, < 5.2.4 → fixed in 5.2.4
Description
Impact
The `MailPreview` feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
1. `debug` mode must be enabled.
2. The hostname must match a 'local' domain or be in an allowlist.
Patches
5.2.4 and 4.10.3 contain patches for this issue.
Workarounds
Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
Related
Alias · CVE (1)
- CVE-2026-54614 DebugKit provides a debugging toolbar for CakePHP applications. vulnerability
Weakness · CWE (1)
- CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness
References
- https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4 web
- https://github.com/cakephp/debug_kit/pull/1078 web
- https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13 web
- https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6 web
- https://github.com/cakephp/debug_kit package
- https://github.com/cakephp/debug_kit/releases/tag/4.10.3 web
- https://github.com/cakephp/debug_kit/releases/tag/5.2.4 web