critical

Exposed app/etc/env.php: the one file that leaks your entire Magento store

Magekwik Security Feb 15, 2026 6 min read

If env.php is downloadable, an attacker has your database password, admin URL, and the encryption key that decrypts customer data. Why it happens, how it is found at scale, and how to lock it down.

Why one file matters this much

app/etc/env.php is Magento's environment configuration. It holds the database host and password, Redis and search endpoints, the admin URL, and — most importantly — the crypt key that encrypts customer data and signs tokens. If that file is downloadable over HTTP, an attacker doesn't need an exploit; they can just read it.

What a leaked env.php gives an attacker

Database credentials, the admin URL, integration secrets, and the encryption key — enough to decrypt stored data, forge admin/JWT tokens, and take over the store. It is a full compromise handed over in one request.

How it gets exposed

The document root is set to the project root instead of pub/, so app/etc/ is web-served.
A misconfigured web server or a "fix" that disables the protective rules in front of app/.
Backups and copies left in the web root: env.php.bak, env.php.save, env.php~, or an app/ folder inside a downloadable archive.

Attackers scan for these paths at internet scale — it is one of the first things automated tooling checks, precisely because the payoff is so high.

How to check your store

Request the path and confirm it is not returned. A correct configuration answers 403/404; a leak returns PHP source starting with <?php.

From an external machine

curl -sS -o /dev/null -w "%{http_code}\n" https://your-store.example/app/etc/env.php
# 200 = EXPOSED (act now). 403/404 = not served.

How to lock it down

Serve the store from pub/ as the document root — Magento's layout keeps app/etc/ outside the web root by design.
Deny access to sensitive paths at the web server as defence in depth.
Remove any backup copies from web-served directories; keep secrets out of the repo.
If it was ever exposed, assume the key is compromised: rotate the encryption key and database credentials, and re-encrypt secrets.

nginx — deny the sensitive tree (defence in depth)

location ~* ^/(app|var|generated|vendor|setup)/ { deny all; }
location = /app/etc/env.php { return 404; }

Beyond env.php

The same class of mistake exposes .git/, composer.lock, app/etc/config.php, and var/log/. If one is reachable, check them all — they leak source, dependency versions, and internal paths that make every other attack easier.

References & sources

Primary sources — advisories, vendor research, and the CVE record. Verify against these, not us.