Cadmos LTI EUVD-2026-91033

Exploitation requires the specific misconfiguration described: Laravel running with APP_DEBUG=true and APP_ENV=local in a publicly reachable deployment. Under this configuration, no special conditions apply - a remote unauthenticated attacker only needs to reach the site and cause any unhandled exception via a GET request to receive the full environment dump. The key LIMITING factor is that this is NOT a default-everywhere flaw: it only affects instances left in debug/local mode in production. A correctly configured Laravel deployment (APP_DEBUG=false, APP_ENV=production) is not exploitable, and the issue was remediated on the hosted instance on or before 2026-09-02, so the window is tied to that specific operator's configuration state.

This is a genuine high-priority exposure, not a theoretical high-CVSS issue, but its blast radius is confined to a single hosted instance. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation: no authentication, no user interaction, low complexity, and an attack that works simply by triggering any unhandled exception via a GET request. The VC:H plus SC:H rating reflects that the exposed .env file leaks downstream secrets (database credentials, API keys, APP_KEY, mail/third-party tokens) that can pivot to subsequent systems, which is the real danger of a debug-mode disclosure. However, several escalation signals are MISSING: no EPSS score was provided, the vulnerability is NOT in CISA KEV, and no POC was supplied - so there is no evidence of active or widespread exploitation. Note also that this is a misconfiguration of one specific production deployment (cadmos.eummena.io) rather than a code flaw shipped to many installs, so the practical footprint is a single operator's environment. Net: urgent to remediate for the affected operator because secrets must be treated as compromised and rotated, but it is not a mass-exploitation campaign risk across many environments.

An unauthenticated attacker browses to cadmos.eummena.io and sends a GET request crafted to trigger any unhandled exception (e.g., an invalid route parameter or malformed input). Because APP_DEBUG=true in a public environment, Laravel's error page renders the full server environment in plaintext, revealing all .env variables including database credentials, APP_KEY, and third-party API tokens. No public exploit identified at time of analysis, but exploitation requires no tooling beyond a web browser.