CVE-2025-58759

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication. The issue is fixed in v1.0.11. Users should upgrade to the latest patched version. As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.

• CWE-20

• https://github.com/datahihi1/tiny-env/security/advisories/GHSA-72cm-7236-h43rVendor Advisory

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58753Copyparty is a portable file server. In versions prior to 1.…7.5
• CVE-2025-58754Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2025-58755MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58756MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58757MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58758TinyEnv is an environment variable loader for PHP applicatio…7.3
• CVE-2025-5876A vulnerability classified as problematic was found in Lucky…5.5
• CVE-2025-58760Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58761Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58762Tautulli is a Python based monitoring and tracking tool for …7.2
• CVE-2025-58763Tautulli is a Python based monitoring and tracking tool for …7.2
• CVE-2025-58764Claude Code is an agentic coding tool. Due to an error in co…9.8