p PatchFirst

CVE-2025-58758

CVE-2025-58758 · TinyEnv: Missing .env file not required — may cause unexpected behavior

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv.

CVSS 5.1 · Media · EPSS 0,2% · Corrección disponible

Publicación
Actualización

Pila tecnológica: php

Productos y versiones afectados

  • tiny-env

    Versiones
    • >= 1.0.1, < 1.0.3: Afectada
    • >= 1.0.9, < 1.0.11: Afectada

    Sin corrección publicada

  • datahihi1/tiny-env Packagist

    Versiones
    • 1.0.1
    • 1.0.2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.0.3

    Actualiza a 1.0.3

  • datahihi1/tiny-env Packagist

    Versiones
    • 1.0.10
    • 1.0.9
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 1.0.9, < 1.0.11

    Actualiza a 1.0.11

Fuentes originales

Comprueba tu servidor →