---
id: CVE-2026-54614
title: DebugKit provides a debugging toolbar for CakePHP applications
summary: >-
  DebugKit provides a debugging toolbar for CakePHP applications. Prior to
  4.10.3 and 5.2.4, the DebugKit MailPreview feature in
  src/Controller/MailPreviewController.php accepts a route-controlled
  previewName value in findPreview and passe…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-470
vendor: cakephp
product: cakephp/debug_kit
affected:
  - cakephp/debug_kit < 4.10.3
  - 'cakephp/debug_kit >= 5.0.0, < 5.2.4'
patched:
  - cakephp/debug_kit 4.10.3
  - cakephp/debug_kit 5.2.4
published: '2026-08-26'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54614'
references:
  - url: >-
      https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13
    label: security-advisories@github.com
  - url: >-
      https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/debug_kit/pull/1078'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/debug_kit/releases/tag/4.10.3'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/debug_kit/releases/tag/5.2.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-p46m-g734-vpc4'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00536
epssPercentile: 0.42779
aliases:
  - GHSA-p46m-g734-vpc4
ecosystem: composer
ingestedAt: '2026-08-26T15:45:52.267Z'
---

## Overview

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54614)

Affected packages:

- `cakephp/debug_kit < 4.10.3`
- `cakephp/debug_kit >= 5.0.0, < 5.2.4`

Patched in:

- `cakephp/debug_kit 4.10.3`
- `cakephp/debug_kit 5.2.4`

Source: https://github.com/advisories/GHSA-p46m-g734-vpc4