CVE-2026-54614

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54614
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54614.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54614
Aliases
Published
2026-08-26T15:30:23Z
Modified
2026-09-11T03:31:03Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
DebugKit: MailPreview contains unsafe reflection
Details

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-470"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54614.json"
}
References

Affected packages

Git / github.com/cakephp/debug_kit

Affected ranges

Type
GIT
Repo
https://github.com/cakephp/debug_kit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
d0b569bd936b31d9b7f4c1d8c283e8d6c0bf61a5
Fixed
5e0fe27721e220d1b1104108edcaf793e98307c0
Fixed
c21a8c1c27edfe9f1b8ab7acff0e96704f4ab4e7
Fixed
7c4d85e984c2334b0f50cd02578a927ff9649e13
Fixed
c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.10.3"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.2.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.1
1.2
1.3.0
2.*
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.12.0
3.17.0
3.17.1
3.18.0
3.19.0
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.20.0
3.20.1
3.20.2
3.20.3
3.20.4
3.20.5
3.21.0
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
3.5.0
3.5.1
3.6.0
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.1
4.10.2
4.2.0
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.5.0
4.6.0
4.7.0
4.7.1
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
5.*
5.0.0
5.0.1
5.2.0
5.2.1
5.2.2
5.2.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54614.json"