THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-54614 (MEDIUM 4.3) — DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className()

[NVD] CVE-2026-54614 (MEDIUM 4.3) — DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className()

mednvdPublished 2026-08-26

CVE-2026-54614 CVSS: 4.3 MEDIUM Published: 2026-08-26T16:16:28.040

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace

Indicators of compromise

CVE-2026-54614cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-54614