CVE-2026-54614: DebugKit: MailPreview contains unsafe reflection
Impact
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
1. debug mode must be enabled. 2. The hostname must match a 'local' domain or be in an allowlist.
Patches 5.2.4 and 4.10.3 contain patches for this issue.
Workarounds Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
Other sources
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/debug_kitto a version that resolves this vulnerability.Fixed in 5.2.4 - Upgrade
Upgrade
composer/cakephp/debug_kitto a version that resolves this vulnerability.Fixed in 4.10.3 - Upgrade
Upgrade
debugkitto a version that resolves this vulnerability.Fixed in 4.10.3 - Upgrade
Upgrade
debugkitto a version that resolves this vulnerability.Fixed in 5.2.4 - Configuration
Ensure debug mode is disabled in production environments so DebugKit is not active.
CakePHP application (production environment) debug mode = disabled - Compensating control
Ensure DebugKit is only included as a development dependency (not in production) so DebugKit MailPreview is not reachable by attackers.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
An application is vulnerable only when debug mode is enabled and the hostname matches a local domain or appears in an allowlist. Production deployments with debug mode disabled do not meet the stated exposure conditions.
What does an attacker need to exploit the flaw?
The attacker must be able to reach the MailPreview feature under an exposed debug-mode deployment. The issue allows arbitrary constructor execution; the supplied data does not specify any additional authentication or interaction requirements.
Which versions fix the vulnerability?
The issue is patched in debugkit versions 5.2.4 and 4.10.3.
What can be done if an update cannot be applied immediately?
Disable debug mode in production environments and ensure debugkit is included only as a development dependency. These measures prevent the conditions described as necessary for exploitation.