CVE-2026-54614

Name of the Vulnerable Software and Affected Versions DebugKit versions prior to 4.10.3 DebugKit versions prior to 5.2.4

Description The MailPreview feature in src/Controller/MailPreviewController.php fails to properly validate the previewName value in the findPreview() function. The application passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKitMailerMailPreview. An attacker with access to DebugKit, provided debug mode is enabled and the request hostname is local or allowlisted, can select an unintended application class via the mail-preview preview route. This leads to arbitrary constructor execution and limited disclosure of application information.

Recommendations Update to version 4.10.3 or newer. Update to version 5.2.4 or newer. Ensure DebugKit is only included in development dependencies and that debug mode is disabled in production environments.