EUVD-2026-66597
GHSA-p46m-g734-vpc4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible debug endpoint requires low-privilege access; impact confined to information disclosure via constructor side-effects with no integrity or availability impact.
Primary rating from Vendor (https://github.com/cakephp/debug_kit).
CVSS VectorVendor: https://github.com/cakephp/debug_kit
Lifecycle Timeline
2DescriptionCVE.org
Impact
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
debugmode must be enabled.- The hostname must match a 'local' domain or be in an allowlist.
Patches
5.2.4 and 4.10.3 contain patches for this issue.
Workarounds
Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
AnalysisAI
Arbitrary PHP constructor execution is possible through the MailPreview feature of CakePHP debug_kit due to unsafe reflection (CWE-470), affecting all 4.x versions below 4.10.3 and 5.x versions below 5.2.4. An attacker with low-privileged network access to an application running in debug mode on a local or allowlisted hostname can pass a fully-qualified PHP class name as the previewName parameter, causing the controller to instantiate arbitrary classes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires both of the following conditions simultaneously: (1) the CakePHP application must have debug mode explicitly enabled (the debug configuration key set to true), which is a non-default setting for production deployments; and (2) the HTTP request hostname must match a 'local' domain (e.g., localhost, .local TLDs) or appear on a configured hostname allowlist maintained by debug_kit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the constrained exploitation environment: while the endpoint is network-accessible with low complexity, two simultaneous preconditions - debug mode enabled and an allowlisted hostname - dramatically narrow the realistic attack surface to development environments only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade cakephp/debug_kit to version 4.10.3 (for 4.x deployments) or 5.2.4 (for 5.x deployments); both versions are confirmed by official GitHub release tags at https://github.com/cakephp/debug_kit/releases/tag/4.10.3 and https://github.com/cakephp/debug_kit/releases/tag/5.2.4 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today