cakephp/debug_kit: MailPreview contains unsafe reflection

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 0.0054, the 45th percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

1. 31 Oct 2026, 14:24 UTC First seen by agentprime
2. 31 Oct 2026, 14:24 UTC Confirmed by OSV

Sources

• GitHub Advisory Database: GHSA-p46m-g734-vpc4
• OSV: GHSA-p46m-g734-vpc4
• github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
• github.com/cakephp/debug_kit/pull/1078
• github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff9649e13
• github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e6eed6
• github.com/cakephp/debug_kit
• github.com/cakephp/debug_kit/releases/tag/4.10.3
• github.com/cakephp/debug_kit/releases/tag/5.2.4

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.