Cadmos Lti
Monthly
Misconfigured Laravel debug mode in the hosted Cadmos LTI application at cadmos.eummena.io exposes the entire server environment - the full plaintext .env file with database credentials, application keys, and third-party service secrets - to any remote attacker who can trigger an unhandled exception with a single GET request. No authentication or user interaction is required (CVSS 4.0 base 9.2; independent assessment CVSS 3.1 9.2, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), but the issue is configuration-dependent rather than a default-everywhere flaw: only deployments left with APP_DEBUG=true and APP_ENV=local in a publicly reachable environment are exploitable. The operator remediated the affected hosted instance on or before 2026-09-02, and no public exploit code has been identified at time of analysis.
Misconfigured Laravel debug mode in the hosted Cadmos LTI application at cadmos.eummena.io exposes the entire server environment - the full plaintext .env file with database credentials, application keys, and third-party service secrets - to any remote attacker who can trigger an unhandled exception with a single GET request. No authentication or user interaction is required (CVSS 4.0 base 9.2; independent assessment CVSS 3.1 9.2, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), but the issue is configuration-dependent rather than a default-everywhere flaw: only deployments left with APP_DEBUG=true and APP_ENV=local in a publicly reachable environment are exploitable. The operator remediated the affected hosted instance on or before 2026-09-02, and no public exploit code has been identified at time of analysis.