p PatchFirst

PatchFirst · Latest vulnerabilities

cakephp/debug_kit vulnerabilities

Vulnerabilities published for cakephp/debug_kit in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-54614

    Medium · CVSS 4.3EPSS 0.54%Fix available

    DebugKit: MailPreview contains unsafe reflection

    DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution

    cakephp/debug_kit cakephp/debug_kitPHP
    • Update to 4.10.3
    • Update to 5.2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →