CVE-2025-58758
Description
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv.
How to fix
- datahihi1 tinyenv1.0.3, 1.0.11 or later
- datahihi1/tiny-env1.0.3, 1.0.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| datahihi1 tinyenv | 1.0.1 ≤ v < 1.0.3, 1.0.9 ≤ v < 1.0.11 | 1.0.3, 1.0.11 |
| datahihi1/tiny-envPackagist | v < 1.0.3, 1.0.9 ≤ v < 1.0.11 | 1.0.3, 1.0.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.