CVE-2025-58758

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-58758
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58758.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-58758
Aliases
Published
2025-09-09T19:50:18.518Z
Modified
2026-04-02T12:56:46.858935Z
Severity
  • 5.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
TinyEnv: Missing .env file not required — may cause unexpected behavior
Details

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the .env file before initializing TinyEnv.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58758.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-703"
    ]
}
References

Affected packages

Git / github.com/datahihi1/tiny-env

Affected ranges

Type
GIT
Repo
https://github.com/datahihi1/tiny-env
Events
Introduced
deedaa6b3f760113623e1482b2ad36615fe8830a
Fixed
1a479f5e786be1614a875d9e845407f83b873a2f
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.1"
        },
        {
            "fixed": "1.0.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/datahihi1/tiny-env
Events
Introduced
64e077577b75215983a91671248178910eeea133
Fixed
69b7b885e6cfbf07f470fb3512360e0caa95521e
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.9"
        },
        {
            "fixed": "1.0.11"
        }
    ]
}

Affected versions

1.*
1.0.1
1.0.10
1.0.2
1.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58758.json"