{"id":"CVE-2025-58758","aliases":["GHSA-3j7m-5g4q-gfpc"],"url":"https://o3.security/vulnerability/CVE-2025-58758","summary":"TinyEnv: Missing .env file not required — may cause unexpected behavior","details":"### Impact\nTinyEnv did not require the `.env` file to exist when loading environment variables.  \nThis could lead to **unexpected behavior** where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations.  \n\nAffected versions:  \n- **1.0.1 → 1.0.2**  \n- **1.0.9 → 1.0.10**\n\n### Patches\nThe issue has been fixed in **version 1.0.11**.  \nAll users should upgrade to `1.0.11` or later.\n\n### Workarounds\nAs a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv, for example:\n\n```php\nif (!file_exists(__DIR__ . '/.env')) {\n    throw new RuntimeException('.env file is missing!');\n}","published":"2025-09-09T19:50:18.518Z","modified":"2026-08-12T03:51:13.459961098Z","cvss":{"score":5.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"score":0.00186,"percentile":0.08174,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"datahihi1/tiny-env","fixedVersion":"1.0.3"},{"ecosystem":"Packagist","name":"datahihi1/tiny-env","fixedVersion":"1.0.11"}],"fix":{"url":"https://github.com/datahihi1/tiny-env/commit/69b7b885e6cfbf07f470fb3512360e0caa95521e","label":"datahihi1/tiny-env@69b7b88"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58758.json"},{"type":"ADVISORY","url":"https://github.com/datahihi1/tiny-env/security/advisories/GHSA-3j7m-5g4q-gfpc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58758"},{"type":"FIX","url":"https://github.com/datahihi1/tiny-env/commit/69b7b885e6cfbf07f470fb3512360e0caa95521e"},{"type":"WEB","url":"https://github.com/datahihi1/tiny-env/commit/7dc656c58bef6050afb8f7a395e38227e31a66df"},{"type":"PACKAGE","url":"https://github.com/datahihi1/tiny-env"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.459961098Z"}}