CVE-2026-54614: cakephp/debug_kit: MailPreview contains unsafe reflection
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
debugmode must be enabled.- The hostname must match a ’local’ domain or be in an allowlist.
References
- github.com/advisories/GHSA-p46m-g734-vpc4
- github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13
- github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
- github.com/cakephp/debug_kit/pull/1078
- github.com/cakephp/debug_kit/releases/tag/4.10.3
- github.com/cakephp/debug_kit/releases/tag/5.2.4
- github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
- nvd.nist.gov/vuln/detail/CVE-2026-54614
Code Behaviors & Features
Detect and mitigate CVE-2026-54614 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →