CVE-2025-58758CWE-703

TinyEnv: Missing .env file not required — may cause unexpected behavior

Medium · published September 9, 2025

CVSS v3.1
5.1
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-703 · Improper Check or Handling of Exceptional Conditions
Published
2025-09-09T19:50Z
EPSS history
Timeline
  • 09 SEP 19:50Z
    TinyEnv: Missing .env file not required — may cause unexpected behavior
    cvelistv5