High severity7.5NVD Advisory· Published Nov 20, 2017· Updated Jun 17, 2026

CVE-2017-16894

Description

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Laravel/Laravel
cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*
Range: <=5.5.21
Laravel/Laravel Frameworkllm-fuzzy
Range: <=5.5.21

Patches

Vulnerability mechanics

References

whiteboyz.xyz/laravel-env-file-vuln.htmlnvdThird Party AdvisoryURL Repurposed
packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.htmlnvd
twitter.com/finnwea/status/967709791442341888nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.070
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000