Summary
cakephp/debug_kit: MailPreview contains unsafe reflection
Advisory details
Impact
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
debugmode must be enabled.- The hostname must match a 'local' domain or be in an allowlist.
Patches
5.2.4 and 4.10.3 contain patches for this issue.
Workarounds
Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
References
- https://github.com/advisories/GHSA-p46m-g734-vpc4
- https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
- https://github.com/cakephp/debug_kit/pull/1078
- https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13
- https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
- https://github.com/cakephp/debug_kit/releases/tag/4.10.3
- https://github.com/cakephp/debug_kit/releases/tag/5.2.4
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-106440
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
- HIGHCVE-2026-106439
Hydra: Mutable instantiate policy sets allow target blocklist bypass
- HIGHCVE-2026-106510
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
- MEDIUMCVE-2026-19032
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
- HIGHCVE-2026-69088
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
- HIGHCVE-2026-65608
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation