CVE-2026-54614 | CakePHP DebugKit up to 4.10.2/5.2.3 MailPreview MailPreviewController.php findPreview previewName code injection

A vulnerability, which was classified as critical, was found in CakePHP DebugKit up to 4.10.2/5.2.3. Affected by this issue is the function findPreview of the file src/Controller/MailPreviewController.php of the component MailPreview. The manipulation of the argument previewName results in code injection.

This vulnerability is known as CVE-2026-54614. It is possible to launch the attack remotely. No exploit is available.

You should upgrade the affected component.VulDB Recent EntriesRead More