CVE-2025-58758 TinyEnv: Missing .env file not required — may cause unexpected behavior
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-58758?
CVE-2025-58758 is a medium-severity vulnerability in datahihi1 tiny-env, published on 9 Sep 2025.
Official description
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv.
Weakness: CWE-703
Which versions are affected by CVE-2025-58758?
4 open source packages ship an affected version, including datahihi1/tiny-env. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
datahihi1/tiny-env Packagist | All versions | 1.0.3 |
datahihi1/tiny-env Packagist | All versions | 1.0.3 |
datahihi1/tiny-env Packagist | From 1.0.9 | 1.0.11 |
datahihi1/tiny-env Packagist | From 1.0.9 | 1.0.11 |
Products include Datahihi1 Tinyenv.
How do I fix CVE-2025-58758?
Upgrade datahihi1/tiny-env to a fixed version for your release line: 1.0.3 or 1.0.11.
Is CVE-2025-58758 being exploited?
There is no known exploitation of CVE-2025-58758 in the wild and no public exploit code.
Other vulnerabilities in datahihi1 tiny-env
Sources
Also known as GHSA-3j7m-5g4q-gfpc.