CVE-2025-70841
Unknown Unknown - Not Provided

Unauthorized File Exposure in Dokans 3.9.2 Enables Full System Compromise

Publication date: 2026-02-03

Last updated on: 2026-02-11

Assigner: MITRE

Description
Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration parameters, enabling complete system compromise including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, this vulnerability affects all tenants in the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-03
Last Modified
2026-02-11
Generated
2026-07-06
AI Q&A
2026-02-04
EPSS Evaluated
2026-07-04
NVD
CVE-2025-70841
EUVD
EUVD-2025-206710

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amcoders dokans 3.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Dokans Multi-Tenancy Based eCommerce Platform SaaS version 3.9.2. It allows unauthenticated remote attackers to access sensitive application configuration data by directly requesting the /script/.env file.

The exposed .env file contains critical information such as the Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and other internal configuration parameters.

Because of this exposure, attackers can completely compromise the system, including bypassing authentication through session token forgery, accessing all tenant data directly from the database, and taking over the email infrastructure.

Due to the platform's multi-tenancy architecture, this vulnerability impacts all tenants hosted on the system.

Impact Analysis

This vulnerability can have severe impacts including complete system compromise.

  • Attackers can bypass authentication by forging session tokens.
  • They can gain direct access to the database and all tenant data.
  • Attackers can take control of the email infrastructure by using exposed SMTP/SendGrid API credentials.

Because the platform is multi-tenant, all tenants on the system are affected, potentially exposing sensitive data and disrupting services for multiple users.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-70841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart