CVE-2025-70841 Information disclosure in n/a
Unauthenticated attackers can access exposed .env files to steal credentials and keys, leading to full system compromise and tenant data theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-70841?
CVE-2025-70841 is a critical vulnerability in n/a, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration parameters, enabling complete system compromise including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, this vulnerability affects all tenants in the system.
Weakness: CWE-287
Which versions are affected by CVE-2025-70841?
It affects 1 product.
Products include Amcoders Dokans.
How do I fix CVE-2025-70841?
No fix has been published for CVE-2025-70841 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-70841 being exploited?
There is no known exploitation of CVE-2025-70841 in the wild and no public exploit code.
Sources
Also known as GHSA-3x28-p955-cr3v.