Vulnerability record · CVE-2017-16894 · published 20 November 2017
CVE-2017-16894: Laravel .env file exposure leaks sensitive credentials
Laravel · Laravel
Laravel framework through 5.5.21 writes the .env file without restricting its permissions via the writeNewEnvironmentFileWith function in KeyGenerateCommand.php, and the file can be retrieved through a direct request to the /.env URI. Because .env holds application secrets such as database credentials, API keys and externally usable passwords, exposure of this file gives attackers the keys to the application's backend systems.
Description
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated network access to a file containing application secrets with a very high EPSS score makes this a high-priority exposure despite no KEV listing.
What it is
Laravel framework through 5.5.21 writes the .env file without restricting its permissions via the writeNewEnvironmentFileWith function in KeyGenerateCommand.php, and the file can be retrieved through a direct request to the /.env URI. Because .env holds application secrets such as database credentials, API keys and externally usable passwords, exposure of this file gives attackers the keys to the application's backend systems.
Impact
An attacker who retrieves /.env obtains sensitive configuration values, including externally usable passwords and other secrets, enabling further compromise of connected services. The flaw is information disclosure only; there is no direct code execution or data modification from this CVE.
Attack surface
Reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N, by sending a direct HTTP request for the /.env path. Exploitation depends on the web server or deployment serving the .env file rather than blocking it.
Exploitation
The CVE is not listed in CISA KEV, but EPSS is very high at 0.869 (99.7th percentile), indicating a strong likelihood of exploitation activity. Reference tags are limited to Third Party Advisory and URL Repurposed, with no vendor advisory or exploit tag supplied.
What to do
- Upgrade Laravel to a version after 5.5.21 that restricts .env file permissions in writeNewEnvironmentFileWith.
- Configure the web server (nginx/Apache) to deny access to .env and other dotfiles, and verify the rule is active.
- Set restrictive filesystem permissions on .env (for example 0600, owned by the application user) and confirm after any key:generate run.
- Rotate all secrets stored in .env (database passwords, API keys, app key) if exposure is suspected.
- Move secrets out of the web root and use environment variables or a secrets manager where possible.
Detection
- Search web server access logs for requests to /.env and other dotfiles, flagging any 200 responses.
- Alert on outbound connections or authentication attempts using credentials that appear in .env files.
- Monitor for changes to .env file permissions or ownership on application hosts.
- Review deployment and CI configuration for .env files placed inside the document root.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-16894 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-16894), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
