Remote command execution In cakephp/debug_kit
Description
cakephp/debug_kit: MailPreview contains unsafe reflection
Impact
The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true:
debug mode must be enabled.
The hostname must match a 'local' domain or be in an allowlist.
Patches
5.2.4 and 4.10.3 contain patches for this issue.
Workarounds
Ensure that debugkit is only part of your development dependencies, and that debug mode is disabled in production environments.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 4.10.3, 5.2.4 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4. 5. 6.