CVE

CVE-2017-16894

7.5

CVSS

Description

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

Attack Vector

Privileges Req.

User Interaction

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~30 seconds

CVE-2017-16894 Scanner

Detects 'Information Disclosure' vulnerability in Laravel framework affects v. through 5.5.21.

Used 3.1k times · 5.9k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →