Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

cakephp/debug_kit

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3PackagistAmendedPublished

    cakephp/debug_kit: MailPreview contains unsafe reflection

    CVE-2026-54614 · GHSA-p46m-g734-vpc4

    Affected
    • Packagist cakephp/debug_kit < 4.10.3; >= 5.0.0, < 5.2.4
    Fixed in
    4.10.35.2.4· Vendor fix available
    Issue
    Impact The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true: 1. debug mode must be enabled. 2. The hostname must match a 'local' domain or be in an allowlist. Patches 5.2.4 and 4.10.3 contain patches for this issue. Workarounds Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.

    Recommended action: Upgrade to 5.2.4 or 4.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →