GHSA-p46m-g734-vpc4MediumCVSS 4.3
cakephp/debug_kit: MailPreview contains unsafe reflection
🔗 CVE IDs covered (1)
📋 Description
Impact
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
debugmode must be enabled.- The hostname must match a 'local' domain or be in an allowlist.
Patches
5.2.4 and 4.10.3 contain patches for this issue.
Workarounds
Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
🎯 Affected products2
- composer/cakephp/debug_kit:< 4.10.3
- composer/cakephp/debug_kit:>= 5.0.0, < 5.2.4
🔗 References (7)
- https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
- https://github.com/cakephp/debug_kit/pull/1078
- https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13
- https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
- https://github.com/cakephp/debug_kit/releases/tag/4.10.3
- https://github.com/cakephp/debug_kit/releases/tag/5.2.4
- https://github.com/advisories/GHSA-p46m-g734-vpc4