Summary
cakephp/debug_kit: MailPreview contains unsafe reflection
Advisory details
Impact
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
debugmode must be enabled.- The hostname must match a 'local' domain or be in an allowlist.
Patches
5.2.4 and 4.10.3 contain patches for this issue.
Workarounds
Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
References
- https://github.com/advisories/GHSA-p46m-g734-vpc4
- https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
- https://github.com/cakephp/debug_kit/pull/1078
- https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13
- https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
- https://github.com/cakephp/debug_kit/releases/tag/4.10.3
- https://github.com/cakephp/debug_kit/releases/tag/5.2.4
Related vulnerabilities
All Supply chain →- CRITICALCVE-2026-55559
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
- HIGHCVE-2026-68508
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
- CRITICALCVE-2026-55107
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
- HIGHCVE-2026-63337
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
- HIGHCVE-2026-55153
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
- MEDIUMCVE-2026-64663
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction