{"id":"GHSA-3j7m-5g4q-gfpc","aliases":["CVE-2025-58758"],"title":"TinyEnv: Missing .env file not required — may cause unexpected behavior","description":"### Impact\nTinyEnv did not require the `.env` file to exist when loading environment variables.  \nThis could lead to **unexpected behavior** where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations.  \n\nAffected versions:  \n- **1.0.1 → 1.0.2**  \n- **1.0.9 → 1.0.10**\n\n### Patches\nThe issue has been fixed in **version 1.0.11**.  \nAll users should upgrade to `1.0.11` or later.\n\n### Workarounds\nAs a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv, for example:\n\n```php\nif (!file_exists(__DIR__ . '/.env')) {\n    throw new RuntimeException('.env file is missing!');\n}","severity":"medium","score":5.1,"published":"2025-09-09T20:59:52.000Z","modified":"2025-09-10T21:54:33.259Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"datahihi1/tiny-env","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.3"}],"type":"ECOSYSTEM"}],"versions":["1.0.1","1.0.2"],"fixed":["1.0.3"]},{"ecosystem":"Packagist","name":"datahihi1/tiny-env","ranges":[{"events":[{"introduced":"1.0.9"},{"fixed":"1.0.11"}],"type":"ECOSYSTEM"}],"versions":["1.0.10","1.0.9"],"fixed":["1.0.11"]}],"references":["https://github.com/datahihi1/tiny-env/security/advisories/GHSA-3j7m-5g4q-gfpc","https://nvd.nist.gov/vuln/detail/CVE-2025-58758","https://github.com/datahihi1/tiny-env/commit/69b7b885e6cfbf07f470fb3512360e0caa95521e","https://github.com/datahihi1/tiny-env/commit/7dc656c58bef6050afb8f7a395e38227e31a66df","https://github.com/datahihi1/tiny-env"],"sources":[{"name":"OSV","id":"GHSA-3j7m-5g4q-gfpc","modified":"2025-09-10T21:54:33.259049Z","url":"https://osv.dev/vulnerability/GHSA-3j7m-5g4q-gfpc"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":5.1}]}