CVE-2025-70841

CriticalPublic PoC

Published: 03 February 2026

Published

03 February 2026

Modified

11 February 2026

KEV Added

—

Patch

—

CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS Score 0.0010 27.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70841 is a critical-severity Improper Authentication (CWE-287) vulnerability in Amcoders Dokans. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and CM-6 (Configuration Settings).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-22 Publicly Accessible Content good match

prevent

Directly mitigates exposure of sensitive .env file contents by controlling and reviewing publicly accessible content to exclude restricted information like APP_KEY and database credentials.

SC-14 Public Access Protections good match

prevent

Protects publicly accessible web endpoints to block unauthorized access to sensitive configuration data in files like /script/.env.

CM-6 Configuration Settings good match

prevent

Enforces secure web server configuration settings to restrict access to sensitive files such as .env, preventing unauthenticated disclosure.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

T1606.001 Web Cookies Credential Access

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

attack.mitre.org →

Why these techniques?

CVE exposes .env config file via unauthenticated HTTP GET on public-facing web app (T1190), revealing credentials in files (T1552.001) and Laravel APP_KEY for forging web cookies/sessions (T1606.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration…

parameters, enabling complete system compromise including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, this vulnerability affects all tenants in the system.

Deeper analysisAI

CVE-2025-70841 is a critical vulnerability in Dokans Multi-Tenancy Based eCommerce Platform SaaS version 3.9.2, where unauthenticated remote attackers can access sensitive application configuration data by directly requesting the /script/.env file. This exposed Laravel environment file discloses the APP_KEY for encryption, database credentials, SMTP/SendGrid API credentials, and other internal parameters. The multi-tenancy architecture means the issue impacts all tenants sharing the system, with a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) and mapped to CWE-287 (Improper Authentication).

Any unauthenticated attacker with network access can exploit this by sending a simple HTTP GET request to the exposed endpoint, retrieving the full contents of the .env file without authentication or user interaction. Successful exploitation enables complete system compromise, including forging session tokens to bypass authentication, directly accessing the database for all tenant data, and taking over email infrastructure via stolen credentials.

Advisories and further details are documented in the product page on CodeCanyon at https://codecanyon.net/item/dokans-multitenancy-based-ecommerce-platform-saas/31122915 and a dedicated security advisory on GitHub at https://github.com/cod3rLucas/security-advisories/blob/main/CVE-2025-70841.md, published on 2026-02-03.