TI-2025-36417 Aliases CVE-2025-58759 GHSA-72cm-7236-h43r

TinyEnv: Inline comments not stripped properly in .env values

LOW 28CWE-20Published 2025-09-09 · Updated 2025-09-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication. The issue is fixed in v1.0.11. Users should upgrade to the latest patched version. As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00206 10th percentileScored 2026-11-07

Fix Fixed tiny-env (datahihi1): 1.0.11datahihi1/tiny-env (Packagist): 1.0.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
datahihi1	tiny-env	1.0.9 to before 1.0.11	1.0.11	Patch available	CNA
—	datahihi1/tiny-env (Packagist)	1.0.9 to before 1.0.11	1.0.11	Patch available	GHSA-72cm-7236-h43r

tiny-env Vendordatahihi1 Affected 1.0.9 to before 1.0.11 Fixed in 1.0.11 Patch available CNA
datahihi1/tiny-env (Packagist) Vendor— Affected 1.0.9 to before 1.0.11 Fixed in 1.0.11 Patch available GHSA-72cm-7236-h43r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:datahihi1:tinyenv::::::::	1.0.9 to before 1.0.11	Vulnerable	datahihi1

cpe:2.3:a:datahihi1:tinyenv:*:*:*:*:*:*:*:* Versions 1.0.9 to before 1.0.11 Vulnerable ·datahihi1

Remediation

Fix · CNA tiny-env (datahihi1) Fixed in 1.0.11
Fix · GHSA-72cm-7236-h43r datahihi1/tiny-env (Packagist) Fixed in 1.0.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-58759
2026-10-03 Alias added: GHSA-72cm-7236-h43r

References

Advisory 2

Other 2

TI-2025-36416 TinyEnv: Missing .env file not required — may cause unexpected behavior CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences