CVE-2026-54614

Deferred Deferred - Pending Action

Arbitrary Code Execution in CakePHP DebugKit

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information. This issue is fixed in versions 4.10.3 and 5.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-54614

EUVD

EUVD-2026-66597

Affected Vendors & Products

Vendor	Product	Version / Range
cakephp	debugkit	to 4.10.3 (exc)
cakephp	debugkit	to 5.2.4 (exc)
cakephp	debug_kit	to 4.10.3 (exc)
cakephp	debug_kit	to 5.2.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Executive Summary

DebugKit is a debugging tool for CakePHP applications. This vulnerability exists in versions before 4.10.3 and 5.2.4. The MailPreview feature allows an attacker with local or allowlisted access to DebugKit while debug mode is enabled to select unintended application classes through a route parameter. This could lead to arbitrary constructor execution and limited disclosure of application information.

Detection Guidance

Check if DebugKit is installed and its version is below 4.10.3 or 5.2.4. Inspect network access to the mail-preview route in DebugKit while debug mode is enabled. Look for unusual class instantiation attempts in application logs.

Impact Analysis

An attacker could exploit this to execute arbitrary code in your application, potentially leading to data breaches or unauthorized access. The impact is limited to applications using DebugKit with debug mode enabled and local or allowlisted hostnames.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, which may violate GDPR or HIPAA compliance requirements. Organizations using affected DebugKit versions should patch immediately to avoid potential regulatory penalties.

Mitigation Strategies

Upgrade DebugKit to version 4.10.3 or 5.2.4 or later. Disable debug mode in production environments. Restrict access to DebugKit routes to trusted hosts only. Review application logs for suspicious activity related to class instantiation.

Hi! I’m here to help you understand CVE-2026-54614. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70