CVE-2025-70841
Unknown Unknown - Not Provided
Unauthorized File Exposure in Dokans 3.9.2 Enables Full System Compromise

Publication date: 2026-02-03

Last updated on: 2026-02-11

Assigner: MITRE

Description
Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration parameters, enabling complete system compromise including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, this vulnerability affects all tenants in the system.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-03
Last Modified
2026-02-11
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-14
NVD
CVE-2025-70841
EUVD
EUVD-2025-206710
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
amcoders dokans 3.9.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Dokans Multi-Tenancy Based eCommerce Platform SaaS version 3.9.2. It allows unauthenticated remote attackers to access sensitive application configuration data by directly requesting the /script/.env file.

The exposed .env file contains critical information such as the Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and other internal configuration parameters.

Because of this exposure, attackers can completely compromise the system, including bypassing authentication through session token forgery, accessing all tenant data directly from the database, and taking over the email infrastructure.

Due to the platform's multi-tenancy architecture, this vulnerability impacts all tenants hosted on the system.

Impact Analysis

This vulnerability can have severe impacts including complete system compromise.

  • Attackers can bypass authentication by forging session tokens.
  • They can gain direct access to the database and all tenant data.
  • Attackers can take control of the email infrastructure by using exposed SMTP/SendGrid API credentials.

Because the platform is multi-tenant, all tenants on the system are affected, potentially exposing sensitive data and disrupting services for multiple users.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-70841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart