CVE-2026-54614Medium· 4.3▾ SunlitDebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passe…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
cakephp/debug_kit < 4.10.3cakephp/debug_kit >= 5.0.0, < 5.2.4Patched in:
cakephp/debug_kit 4.10.3cakephp/debug_kit 5.2.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-79752Critical· 9.2CakePHP is a rapid development framework for PHP
CVE-2026-77635CriticalCakePHP is a rapid development framework for PHP
CVE-2026-77634HighCakePHP is a rapid development framework for PHP
CVE-2026-54713Low· 3.7CakePHP Queue is a queue-interop compatible queueing library
CVE-2026-55590MediumCakePHP Authentication: Open redirect weakness via backslash bypass
CVE-2026-48820MediumCakePHP: View::element() is missing a path containment check