CVE-2025-58758: tinyenv — Fix

Description

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv.

Is your site exposed to CVE-2025-58758?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness Type (CWE)

CWE-703 CWE-703

Affected Products

Vendor	Product	Versions
datahihi1	tinyenv	1.0.1 — 1.0.3
datahihi1	tinyenv	1.0.9 — 1.0.11

References

Advisories & Patches

https://github.com/datahihi1/tiny-env/commit/69b7b885e6cfbf07f470fb3512360e0caa95521e https://github.com/datahihi1/tiny-env/security/advisories/GHSA-3j7m-5g4q-gfpc

Frequently Asked Questions

What is CVE-2025-58758? +

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv. It has a CVSS v3.1 base score of 5.1 (MEDIUM).

How severe is CVE-2025-58758? +

CVE-2025-58758 has a CVSS v3.1 score of 5.1 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-58758? +

CVE-2025-58758 affects products from datahihi1, specifically: tinyenv. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-58758? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-24371

CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and …

CVE-2024-21894 9.8

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated …

CVE-2025-13023 9.8

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and …

CVE-2025-13021 9.8

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.

CVE-2025-13022 9.8