Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for debug_kit by cakephp

    CVE-2026-54614 (GCVE-0-2026-54614)

    Vulnerability from nvd – Published: 2026-08-26 15:30 – Updated: 2026-08-29 02:40
    VLAI
    Title
    DebugKit: MailPreview contains unsafe reflection
    Summary
    DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-29 02:39 UTC
    CWE
    • CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    cakephp debug_kit Affected: < 4.10.3
    Affected: >= 5.0.0, < 5.2.4
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54614",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-29T02:39:54.252351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-29T02:40:09.901Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "debug_kit",
          "vendor": "cakephp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.10.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\\Mailer\\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T15:30:23.966Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/pull/1078",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/pull/1078"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/releases/tag/4.10.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/releases/tag/4.10.3"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/releases/tag/5.2.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/releases/tag/5.2.4"
        }
      ],
      "source": {
        "advisory": "GHSA-p46m-g734-vpc4",
        "discovery": "UNKNOWN"
      },
      "title": "DebugKit: MailPreview contains unsafe reflection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54614",
    "datePublished": "2026-08-26T15:30:23.966Z",
    "dateReserved": "2026-06-15T19:45:23.541Z",
    "dateUpdated": "2026-08-29T02:40:09.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54614 (GCVE-0-2026-54614)

    Vulnerability from cvelistv5 – Published: 2026-08-26 15:30 – Updated: 2026-08-29 02:40
    VLAI
    Title
    DebugKit: MailPreview contains unsafe reflection
    Summary
    DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-29 02:39 UTC
    CWE
    • CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    cakephp debug_kit Affected: < 4.10.3
    Affected: >= 5.0.0, < 5.2.4
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54614",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-29T02:39:54.252351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-29T02:40:09.901Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "debug_kit",
          "vendor": "cakephp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.10.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\\Mailer\\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T15:30:23.966Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/pull/1078",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/pull/1078"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/releases/tag/4.10.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/releases/tag/4.10.3"
        },
        {
          "name": "https://github.com/cakephp/debug_kit/releases/tag/5.2.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/debug_kit/releases/tag/5.2.4"
        }
      ],
      "source": {
        "advisory": "GHSA-p46m-g734-vpc4",
        "discovery": "UNKNOWN"
      },
      "title": "DebugKit: MailPreview contains unsafe reflection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54614",
    "datePublished": "2026-08-26T15:30:23.966Z",
    "dateReserved": "2026-06-15T19:45:23.541Z",
    "dateUpdated": "2026-08-29T02:40:09.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}