CVE-2026-55584: phpSysInfo IP allowlist bypass via header spoofing

CVE-2026-55584 · Severity: high · CVSS 7.5 · Published 2026-08-28

phpSysInfo is a system monitoring application that displays server information like CPU, memory, and network configuration. Organizations often restrict access to this tool using an IP allowlist to prevent unauthorized information disclosure. However, the application trusts attacker-controlled HTTP headers (X-Forwarded-For and Client-IP) for IP validation before checking the actual client IP, allowing unauthenticated attackers to spoof a trusted IP address and completely bypass the access restriction.

Technologies: phpsysinfo/phpsysinfo (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55584 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55584 being exploited in the wild.
How severe is CVE-2026-55584?
High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?
phpsysinfo/phpsysinfo (Packagist) <= 3.4.5, ECOSYSTEM:introduced=0,fixed=3.4.6; phpSysInfo &lt;= 3.4.5.
Is there a fix for CVE-2026-55584?
Yes. phpsysinfo/phpsysinfo (Packagist): upgrade to 3.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55584 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55584?
Check whether you run phpsysinfo/phpsysinfo (Packagist) or phpSysInfo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpsysinfo/phpsysinfo (Packagist): upgrade to 3.4.6 or later
    composer require phpsysinfo/phpsysinfo:^3.4.6

Technical details

This is an authentication bypass vulnerability (CWE-290: Authentication Bypass by Spoofing) in the IP-based access control mechanism. The vulnerable code in read_config.php checks HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP headers before using REMOTE_ADDR to determine the client's IP address. Since these headers are fully attacker-controlled and there is no concept of trusted reverse proxies or proper chain parsing, an attacker can trivially spoof any allowed IP address. The vulnerability has no authentication requirement, requires no user interaction, and is exploitable over the network. An attacker can immediately obtain complete system information including hostname, kernel version, CPU model, memory layout, mounted filesystems, and network interface addresses—valuable reconnaissance data for targeting further attacks. The vulnerability affects all versions up to and including 3.4.5; version 3.4.6 and later include a fix that validates the request only comes from a configured trusted proxy before honoring forwarded headers.

Affected products

  • phpsysinfo phpSysInfo &lt;= 3.4.5

Identifiers

  • CVE-2026-55584
  • GHSA-786w-p5pm-cvgh

Timeline

  • 2026-06-22: disclosed: Published to GitHub Advisory Database
  • 2026-06-22: patched: Version 3.4.6 released with fix
  • 2026-08-28: advisory: Advisory updated with additional details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.