Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M
CVE-2026-55584phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
High 7.5
In plain English
A high-severity authentication bypass by spoofing in phpsysinfo from phpsysinfo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | phpsysinfo | no fix listed | DEBIAN-CVE-2026-55584 |
| Debian:13 | phpsysinfo | no fix listed | DEBIAN-CVE-2026-55584 |
| Debian:14 | phpsysinfo | no fix listed | DEBIAN-CVE-2026-55584 |
| Packagist | phpsysinfo/phpsysinfo | 3.4.6 | GHSA-786w-p5pm-cvgh |
| Ubuntu:22.04:LTS | phpsysinfo | no fix listed | UBUNTU-CVE-2026-55584 |
| Ubuntu:24.04:LTS | phpsysinfo | no fix listed | UBUNTU-CVE-2026-55584 |
| Ubuntu:26.04:LTS | phpsysinfo | no fix listed | UBUNTU-CVE-2026-55584 |
| Ubuntu:26.10 | phpsysinfo | no fix listed | UBUNTU-CVE-2026-55584 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| phpsysinfo | phpsysinfo | < 3.4.6 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N