PT-2026-5987 · Unknown · Dokans Multi-Tenancy Based Ecommerce Platform

Published 2026-02-03 · Updated 2026-02-11 · CVE-2025-70841

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Dokans Multi-Tenancy Based eCommerce Platform version 3.9.2

Description The platform allows unauthenticated remote attackers to obtain sensitive application configuration data by directly requesting the '/script/.env' file. This file contains the Laravel application encryption key (APP KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration parameters. Exploitation can lead to complete system compromise, including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, all tenants in the system are affected.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-70841

Affected Products

Dokans Multi-Tenancy Based Ecommerce Platform

References · 7

• 🔥 https://github.com/cod3rLucas/security-advisories/blob/main/CVE-2025-70841.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-70841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70841 · Security Note
• https://codecanyon.net/item/dokans-multitenancy-based-ecommerce-platform-saas/31122915 · Note
• https://twitter.com/MNovofastovsky/status/2020949824774844496 · Twitter Post
• https://t.me/cveNotify/151712 · Telegram Post
• https://t.me/CVEtracker/43624 · Telegram Post