TI-2025-36416 Aliases CVE-2025-58758 GHSA-3j7m-5g4q-gfpc

TinyEnv: Missing .env file not required — may cause unexpected behavior

LOW 31CWE-703Published 2025-09-09 · Updated 2025-09-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00186 8th percentileScored 2026-11-07

Fix Fixed tiny-env (datahihi1): 1.0.3, 1.0.11datahihi1/tiny-env (Packagist): 1.0.3, 1.0.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
datahihi1	tiny-env	1.0.1 to before 1.0.3; 1.0.9 to before 1.0.11	1.0.3, 1.0.11	Patch available	CNA
—	datahihi1/tiny-env (Packagist)	before 1.0.3	1.0.3	Patch available	GHSA-3j7m-5g4q-gfpc
—	datahihi1/tiny-env (Packagist)	1.0.9 to before 1.0.11	1.0.11	Patch available	GHSA-3j7m-5g4q-gfpc

tiny-env Vendordatahihi1 Affected 1.0.1 to before 1.0.3; 1.0.9 to before 1.0.11 Fixed in 1.0.3, 1.0.11 Patch available CNA
datahihi1/tiny-env (Packagist) Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available GHSA-3j7m-5g4q-gfpc
datahihi1/tiny-env (Packagist) Vendor— Affected 1.0.9 to before 1.0.11 Fixed in 1.0.11 Patch available GHSA-3j7m-5g4q-gfpc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:datahihi1:tinyenv::::::::	1.0.1 to before 1.0.3; 1.0.9 to before 1.0.11	Vulnerable	datahihi1

cpe:2.3:a:datahihi1:tinyenv:*:*:*:*:*:*:*:* Versions 1.0.1 to before 1.0.3; 1.0.9 to before 1.0.11 Vulnerable ·datahihi1

Remediation

Fix · CNA tiny-env (datahihi1) Fixed in 1.0.3, 1.0.11
Fix · GHSA-3j7m-5g4q-gfpc datahihi1/tiny-env (Packagist) Fixed in 1.0.3 Advisory →
Fix · GHSA-3j7m-5g4q-gfpc datahihi1/tiny-env (Packagist) Fixed in 1.0.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-58758
2026-10-03 Alias added: GHSA-3j7m-5g4q-gfpc

References

Patch 1

https://github.com/datahihi1/tiny-env/commit/69b7b885e6cfbf07f470fb3512360e0caa95521e

Advisory 2

Other 2

TI-2025-36417 TinyEnv: Inline comments not stripped properly in .env values CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences