CVE-2017-16894

CVE-2017-16894 describes an information disclosure vulnerability in Laravel framework versions through 5.5.21, allowing remote attackers to retrieve sensitive data like passwords by directly requesting the /.env file. This flaw stems from the writeNewEnvironmentFileWith function not properly restricting .env file permissions. The vulnerability carries a high CVSS score of 7.5, indicating a network-based attack with low complexity and high confidentiality impact. While not listed in CISA's KEV catalog, exploit intelligence shows available Metasploit modules and Nuclei templates, suggesting potential for exploitation despite limited public discussion or media coverage.