critical

Exposed app/etc/env.php: the one file that leaks your entire Magento store

Kishore Adobe Commerce Certified Professional Published 10 August 2026 6 min read

Covers events from 15 February 2026.

If env.php is downloadable, an attacker has your database password, admin URL, and the encryption key that decrypts customer data. Why it happens, how it is found at scale, and how to lock it down.

Why one file matters this much

app/etc/env.php is Magento's environment configuration. It holds the database host and password, Redis and search endpoints, the admin URL and, most importantly, the crypt key that encrypts customer data and signs tokens. If that file is downloadable over HTTP, an attacker needs no exploit. They read it.

What a leaked env.php gives an attacker

Database credentials, the admin URL, integration secrets, and the encryption key. That is enough to decrypt stored data, forge admin/JWT tokens and take over the store, from one request.

How it gets exposed

The document root is set to the project root instead of pub/, so app/etc/ is web-served.
A misconfigured web server or a "fix" that disables the protective rules in front of app/.
Backups and copies left in the web root: env.php.bak, env.php.save, env.php~, or an app/ folder inside a downloadable archive.

Attackers scan for these paths at internet scale. Automated tooling checks it early because the payoff is high.

How to check your store

Request the path and confirm it is not returned. A correct configuration answers 403/404; a leak returns PHP source starting with <?php.

From an external machine

curl -sS -o /dev/null -w "%{http_code}\n" https://your-store.example/app/etc/env.php
# 200 = EXPOSED (act now). 403/404 = not served.

How to lock it down

Serve the store from pub/ as the document root. Magento's layout keeps app/etc/ outside the web root by design.
Deny access to sensitive paths at the web server as defence in depth.
Remove any backup copies from web-served directories; keep secrets out of the repo.
If it was ever exposed, assume the key is compromised: rotate the encryption key and database credentials, and re-encrypt secrets.

nginx: deny the sensitive tree (defence in depth)

location ~* ^/(app|var|generated|vendor|setup)/ { deny all; }
location = /app/etc/env.php { return 404; }

Beyond env.php

The same class of mistake exposes .git/, composer.lock, app/etc/config.php, and var/log/. If one is reachable, check them all. They leak source, dependency versions and internal paths that make every other attack easier.

References & sources

Primary sources: advisories, vendor research and the CVE record. Verify against these rather than against us.