{"id":"GHSA-3j7m-5g4q-gfpc","summary":"TinyEnv: Missing .env file not required — may cause unexpected behavior","details":"### Impact\nTinyEnv did not require the `.env` file to exist when loading environment variables.  \nThis could lead to **unexpected behavior** where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations.  \n\nAffected versions:  \n- **1.0.1 → 1.0.2**  \n- **1.0.9 → 1.0.10**\n\n### Patches\nThe issue has been fixed in **version 1.0.11**.  \nAll users should upgrade to `1.0.11` or later.\n\n### Workarounds\nAs a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv, for example:\n\n```php\nif (!file_exists(__DIR__ . '/.env')) {\n    throw new RuntimeException('.env file is missing!');\n}","aliases":["CVE-2025-58758"],"modified":"2025-09-10T21:54:33.259049Z","published":"2025-09-09T20:59:52Z","database_specific":{"github_reviewed_at":"2025-09-09T20:59:52Z","nvd_published_at":"2025-09-09T20:15:49Z","cwe_ids":["CWE-703"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/datahihi1/tiny-env/security/advisories/GHSA-3j7m-5g4q-gfpc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58758"},{"type":"WEB","url":"https://github.com/datahihi1/tiny-env/commit/69b7b885e6cfbf07f470fb3512360e0caa95521e"},{"type":"WEB","url":"https://github.com/datahihi1/tiny-env/commit/7dc656c58bef6050afb8f7a395e38227e31a66df"},{"type":"PACKAGE","url":"https://github.com/datahihi1/tiny-env"}],"affected":[{"package":{"name":"datahihi1/tiny-env","ecosystem":"Packagist","purl":"pkg:composer/datahihi1/tiny-env"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}],"versions":["1.0.1","1.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-3j7m-5g4q-gfpc/GHSA-3j7m-5g4q-gfpc.json"}},{"package":{"name":"datahihi1/tiny-env","ecosystem":"Packagist","purl":"pkg:composer/datahihi1/tiny-env"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.11"}]}],"versions":["1.0.10","1.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-3j7m-5g4q-gfpc/GHSA-3j7m-5g4q-gfpc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}