CVE-2025-58759CWE-20

TinyEnv: Inline comments not stripped properly in .env values

Medium · published September 9, 2025

CVSS v3.1
5.1
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication. The issue is fixed in v1.0.11. Users should upgrade to the latest patched version. As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-09-09T19:52Z
EPSS history
Timeline
  • 09 SEP 19:52Z
    TinyEnv: Inline comments not stripped properly in .env values
    cvelistv5