CVE-2025-70841

CVE-2025-70841 is a critical information disclosure vulnerability affecting Dokans Multi-Tenancy Based eCommerce Platform SaaS version 3.9.2. Unauthenticated attackers can directly access the /script/.env file, exposing sensitive application configuration data. This includes the Laravel APP_KEY, database credentials, and SMTP/SendGrid API keys, leading to severe consequences such as authentication bypass, full database access across all tenants, and email infrastructure compromise. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and no user interaction required, resulting in high confidentiality impact. Its FAUCET Risk Score is 91/100, highlighting its significant risk. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or community discussion has been observed. Despite the lack of current exploitation, the high potential impact necessitates immediate remediation.