CVE-2025-58758: TinyEnv Package Missing .env File Requirement Leading to Potential Misconfigurations
Summary
CVE-2025-58758: TinyEnv: Missing .env file not required — may cause unexpected behavior. Affects datahihi1/tiny-env across 2 version ranges.
< 1.0.3
>= 1.0.9, < 1.0.11
Fixed in 1.0.3 or 1.0.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyEnv is a PHP package designed to simplify the management of environment variables in applications. It allows developers to load configuration settings from a .env file, which is a common practice in modern PHP applications. However, the package has a vulnerability that arises from not requiring the .env file to exist, which can lead to unexpected behavior and insecure defaults.
Vulnerability Detail
The vulnerability in TinyEnv stems from its failure to enforce the existence of the .env file when loading environment variables. This oversight can result in applications silently ignoring missing configurations, leading to potential deployment misconfigurations and insecure defaults. The affected versions are 1.0.1 to 1.0.2 and 1.0.9 to 1.0.10. The technical implications include the risk of applications operating without necessary configurations, which could expose sensitive data or lead to application failures.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.0.31.0.3composer require datahihi1/tiny-env:1.0.3 -
>= 1.0.9, < 1.0.111.0.11composer require datahihi1/tiny-env:1.0.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually check for the existence of the .env file before initializing TinyEnv. The following PHP code snippet demonstrates how to implement this check:
if (!file_exists(__DIR__ . '/.env')) {
throw new RuntimeException('.env file is missing!');
}
Conclusion
In summary, the vulnerability in TinyEnv due to the missing .env file requirement poses significant risks for applications relying on this package. Users are strongly encouraged to upgrade to version 1.0.11 or later to mitigate these risks. Implementing the provided workaround can also help in the interim.
See every vulnerability recorded for datahihi1/tiny-env →
FAQ
The impact includes potential application misconfigurations and insecure defaults, which could lead to data exposure or application failures.
Affected versions include 1.0.1 to 1.0.2 and 1.0.9 to 1.0.10.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate upgrade is not possible, implement the provided workaround to check for the .env file before initializing TinyEnv.
The CVSS score of this vulnerability is 5.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for datahihi1/tiny-env.
