CVE-2026-54614: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in cakephp debug_kit

The DebugKit MailPreview feature in CakePHP versions before 4.10.3 and 5.2.4 accepts a route-controlled previewName parameter that is resolved to a class name via App::className() without filtering namespace separators or verifying inheritance from DebugKit\Mailer\MailPreview. This allows an attacker with DebugKit access under debug mode and local or allowlisted hostname conditions to select unintended application classes, resulting in arbitrary constructor execution and limited information disclosure. The vulnerability is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code).

An attacker able to access DebugKit while debug mode is enabled and the request originates from a local or allowlisted hostname can exploit this vulnerability to execute arbitrary constructors of unintended classes. This may lead to limited disclosure of application information. There is no indication of privilege escalation, denial of service, or remote code execution beyond constructor invocation. Known exploits in the wild have not been reported.

This vulnerability is fixed in CakePHP DebugKit versions 4.10.3 and 5.2.4. Users should upgrade to these or later versions to remediate the issue. No other official remediation or temporary fixes are documented. If upgrading is not immediately possible, restricting access to DebugKit and disabling debug mode in production environments can reduce exposure.