The vulnerability lies in DebugKit’s MailPreview feature, which accepts a preview name from a route and resolves it to a class name without rejecting namespace separators or checking that it extends the expected mail preview interface. This unsafe reflection allows an attacker to instantiate any class that can be resolved by the framework, leading to arbitrary constructor execution and the potential exposure of application data or configuration. The vulnerability is classified as CWE‑470, indicating code execution through unsafe dynamic code loading.

Vulnerable releases are all CakePHP DebugKit versions prior to 4.10.3 and 5.2.4, which expose the MailPreview controller to unchecked class resolution. Any application using DebugKit in debug mode, with access to the /debugkit/mail-preview route from a local or allowlisted host, is affected.

The CVSS score of 4.3 indicates moderate severity, and the absence of an EPSS rating suggests limited known exploitation activity. The exploit requires debug mode to be enabled and the attacker to reach the application from a host that is allowed to trigger debug features, so it is not a public‑Internet remote execution risk but remains significant for developers running DebugKit locally or in internal environments. Because it is not listed in the KEV catalog, there are no known active exploits in the wild reported by that authority.