CVE-2026-55584

Received Received - Intake

phpSysInfo 3.4.5 X-Forwarded-For Header Access Bypass

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55584

EUVD

EUVD-2026-67862

Affected Vendors & Products

Vendor	Product	Version / Range
phpsysinfo	phpsysinfo	3.4.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

CVE-2026-55584 is a vulnerability in phpSysInfo versions 3.4.5 and earlier that allows unauthenticated remote attackers to bypass IP allowlist restrictions by spoofing X-Forwarded-For or Client-IP HTTP headers. The application prioritizes these attacker-controlled headers over REMOTE_ADDR to determine client IP, enabling unauthorized access to sensitive system information.

Detection Guidance

To detect this vulnerability, check if phpSysInfo is running a version prior to 3.4.6 by examining the version in the application or server logs. Inspect HTTP headers in requests to phpSysInfo for X-Forwarded-For or Client-IP fields that may contain spoofed allowed IP addresses. Use network monitoring tools to identify unauthorized access attempts to sensitive system information endpoints.

Impact Analysis

An attacker could exploit this to impersonate a trusted client and access sensitive system details such as hostname, kernel version, CPU, memory, filesystems, and network interfaces. This could lead to information disclosure or further attacks if combined with other vulnerabilities.

Mitigation Strategies

Immediately upgrade phpSysInfo to version 3.4.6 or later. Configure the TRUSTED_PROXIES setting to explicitly define trusted proxy servers and validate client IPs from headers. Ensure REMOTE_ADDR is prioritized over untrusted headers like X-Forwarded-For or Client-IP unless requests originate from configured trusted proxies.

Hi! I’m here to help you understand CVE-2026-55584. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70