CVE-2026-54614: CakePHP DebugKit RCE Vulnerability

CVE-2026-54614 Overview

CVE-2026-54614 is an unsafe reflection vulnerability [CWE-470] in DebugKit, the debugging toolbar shipped for CakePHP applications. The flaw exists in the MailPreview feature located in src/Controller/MailPreviewController.php. Versions prior to 4.10.3 and 5.2.4 accept a route-controlled previewName value inside findPreview and pass the resolved class from App::className() directly to constructor execution. The controller does not reject namespace separators or verify that the resolved class extends DebugKit\Mailer\MailPreview. An attacker who can reach DebugKit while debug mode is enabled on a local or allowlisted host can instantiate arbitrary application classes and disclose limited application information.

Critical Impact
Attackers with access to DebugKit routes can trigger arbitrary constructor execution on unintended application classes, exposing internal application state.

Affected Products

CakePHP DebugKit versions prior to 4.10.3
CakePHP DebugKit versions prior to 5.2.4
CakePHP applications running DebugKit with debug mode enabled on local or allowlisted hosts

Discovery Timeline

2026-08-26 - CVE-2026-54614 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54614

Vulnerability Analysis

DebugKit's MailPreviewController exposes a route that accepts a previewName parameter representing the mail preview class to instantiate. Inside findPreview, the controller passes this user-controlled value to App::className() and instantiates the returned class. The resolver does not filter namespace separators or reject fully qualified names, so callers can point to any class reachable through the application autoloader. The controller also fails to enforce that the resolved class extends DebugKit\Mailer\MailPreview, meaning classes outside the mail preview hierarchy can be constructed.

Instantiation triggers the target class constructor with no arguments. Depending on the application, constructors can perform side effects such as reading configuration, opening resources, or initializing state that becomes observable through the preview response. The result is arbitrary constructor execution paired with limited information disclosure about the running application.

Root Cause

The root cause is unsafe reflection [CWE-470]. MailPreviewController::findPreview treats a route parameter as trusted class-name input, delegates resolution to App::className(), and calls the constructor without validating that the class inherits from DebugKit\Mailer\MailPreview. No allowlist, namespace check, or type constraint gates the reflection step.

Attack Vector

Exploitation requires that DebugKit is loaded, debug mode is enabled, and the request hostname matches the local or allowlisted set. An attacker who satisfies those preconditions crafts a request to the mail-preview route with a previewName value that resolves, through App::className(), to an unintended application class. The controller instantiates that class, running its constructor and returning preview-related output that can leak internal state.

php

// Security patch in src/Controller/MailPreviewController.php
// Constrain classes further in MailPreview controller (#1078)
 use Cake\Routing\Router;
 use Cake\Utility\Inflector;
 use DebugKit\Mailer\AbstractResult;
+use DebugKit\Mailer\MailPreview;
 use DebugKit\Mailer\PreviewResult;
 use DebugKit\Mailer\SentMailResult;
// Source: https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13

The patch imports DebugKit\Mailer\MailPreview so the controller can enforce that resolved classes inherit from the expected base class before instantiation. See the GitHub Security Advisory GHSA-p46m-g734-vpc4 for the full fix.

Detection Methods for CVE-2026-54614

Indicators of Compromise

Requests to DebugKit mail-preview routes containing previewName values with namespace separators or fully qualified class names.
Unexpected access to /debug-kit/mail_preview/* endpoints from external or non-developer hosts.
Application error logs referencing class instantiation failures originating from MailPreviewController::findPreview.

Detection Strategies

Inspect access logs for DebugKit routes reached in production or on internet-facing hosts, which indicates a misconfiguration precondition for this vulnerability.
Alert on HTTP requests where previewName route parameters contain \, /, or class-like identifiers unrelated to mail previews.
Correlate DebugKit route access with debug mode being enabled by reviewing deployment configuration and runtime environment variables.

Monitoring Recommendations

Track DebugKit package versions across all CakePHP deployments and flag anything below 4.10.3 (4.x) or 5.2.4 (5.x).
Monitor for debug flag changes in config/app.php or environment variables in non-development environments.
Baseline expected callers of DebugKit routes and alert on new source IPs, particularly outside developer network ranges.

How to Mitigate CVE-2026-54614

Immediate Actions Required

Upgrade DebugKit to 4.10.3 or 5.2.4 as documented in the 4.10.3 release notes and 5.2.4 release notes.
Confirm debug is set to false in all production and internet-facing environments.
Restrict DebugKit's allowlisted hostnames to genuine development hosts and remove wildcard or overly broad entries.

Patch Information

The fix constrains MailPreviewController to only instantiate classes extending DebugKit\Mailer\MailPreview. Review the upstream commits at 7c4d85e and c8a2a9e, plus the corresponding pull request #1078.

Workarounds

Remove DebugKit from composer.jsonrequire and move it to require-dev so it is not installed in production builds.
Disable DebugKit loading in production by not calling $this->addPlugin('DebugKit') when the environment is not development.
Block DebugKit routes at the reverse proxy or web server layer for any host that is not an authorized developer workstation.

bash

# Configuration example - ensure debug mode is disabled in production
# config/app.php or environment variable
export DEBUG=false

# Remove DebugKit from production dependencies
composer remove cakephp/debug_kit
composer require --dev cakephp/debug_kit:^5.2.4