Critical · published February 3, 2026
🚨 A direct request to a specific URL could leak all sensitive configuration data from Dokan's platform—no authentication required! 🔥 Think of it like leaving your front door wide open while forgetting to put away all your valuables — a simple push can let anyone walk in and take everything in sight! An attacker could obtain the application's encryption key, database credentials, and API keys with ease, leading to complete control over the system. This means they could bypass authentication, access all tenant data, and even hijack the email infrastructure. The consequences could be absolutely devastating for every tenant using the platform!
Think of it like leaving your front door wide open while forgetting to put away all your valuables — a simple push can let anyone walk in and take everything in sight! This vulnerability allows unauthenticated attackers to directly access the sensitive .env file of the Dokan Multi-Tenancy based eCommerce Platform, revealing critical application secrets.
An attacker could obtain the application's encryption key, database credentials, and API keys with ease, leading to complete control over the system. This means they could bypass authentication, access all tenant data, and even hijack the email infrastructure. The consequences could be absolutely devastating for every tenant using the platform! Immediately patch to version 3.9.3 or later to secure your application. Additionally, implement proper access controls to prevent unauthorized access to sensitive files and conduct a security audit of all environment variables. Don't forget to rotate any exposed credentials! You've got this! With these steps, you'll reinforce your defenses and protect your application like a pro! 🛡️