Environment Variable Loader Vulnerability in TinyEnv by Datahihi1
CVE-2025-58759

5.1MEDIUM

Key Information:

Vendor

Datahihi1

Status
Tiny-env
Vendor
CVE Published:
9 September 2025

What is CVE-2025-58759?

TinyEnv, an environment variable loader for PHP applications, has a critical flaw in versions 1.0.9 and 1.0.10 where it fails to correctly strip inline comments within .env values. This oversight can lead to misconfigurations that introduce unintended characters like '#' or comment text into environment variables, potentially causing logic errors, insecure defaults, or authentication failures in applications reliant on precise environment settings. Users are advised to upgrade to version 1.0.11, which addresses this issue, and to avoid using inline comments in .env files or manually sanitize loaded values as a temporary measure.

Affected Version(s)

tiny-env >= 1.0.9, < 1.0.11

References

https://github.com/datahihi1/tiny-env/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-58759 : Environment Variable Loader Vulnerability in TinyEnv by Datahihi1