PT-2026-5987 · Unknown · Dokans Multi-Tenancy Based Ecommerce Platform

CVE-2025-70841 · Publicado 2026-02-03 · Atualizado 2026-02-11

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Dokans Multi-Tenancy Based eCommerce Platform version 3.9.2

Description The platform allows unauthenticated remote attackers to obtain sensitive application configuration data by directly requesting the '/script/.env' file. This file contains the Laravel application encryption key (APP KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration parameters. Exploitation can lead to complete system compromise, including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, all tenants in the system are affected.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2025-70841

Produtos afetados

Dokans Multi-Tenancy Based Ecommerce Platform

Referências · 7

• 🔥 https://github.com/cod3rLucas/security-advisories/blob/main/CVE-2025-70841.md · Exploit
• https://codecanyon.net/item/dokans-multitenancy-based-ecommerce-platform-saas/31122915 · Nota
• https://twitter.com/MNovofastovsky/status/2020949824774844496 · Publicação no Twitter
• https://t.me/cveNotify/151712 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-70841 · Aviso do Fabricante
• https://t.me/CVEtracker/43624 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-70841 · Nota de Segurança