CVE-2026-55584: phpSysInfo IP Allowlist Bypass via Spoofed Headers
Summary
CVE-2026-55584: phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers. Affects phpsysinfo/phpsysinfo versions < 3.4.6. Fixed in 3.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpSysInfo is an open-source tool designed to display system information in a user-friendly manner. It provides insights into various system metrics such as CPU usage, memory layout, and network interfaces. The application employs an IP allowlist feature (PSI_ALLOWED) to restrict access to trusted IP addresses. However, a critical vulnerability exists that allows unauthorized users to bypass this restriction, exposing sensitive system information.
Vulnerability Detail
The vulnerability in phpSysInfo arises from the way it processes client IP addresses in the read_config.php file. The application first checks the X-Forwarded-For and Client-IP headers, both of which can be manipulated by an attacker. If these headers are present, the application uses them to determine the client's IP address before falling back to REMOTE_ADDR. This design flaw allows an attacker to spoof their IP address by sending a request with a forged X-Forwarded-For header, effectively bypassing the IP allowlist and gaining unauthorized access to sensitive system information.
How To Fix
Minimum fixed version
3.4.6
This is the first release that contains the fix.
composer require phpsysinfo/phpsysinfo:3.4.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the code in read_config.php to prioritize REMOTE_ADDR over the spoofed headers. Here is an example of how to implement this change:
$ip = $_SERVER["REMOTE_ADDR"];
if (defined('PSI_TRUSTED_PROXIES') && in_array($ip, $trusted_proxies, true)
&& isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
// take the right-most untrusted hop from the XFF chain
$parts = array_map('trim', explode(',', $_SERVER["HTTP_X_FORWARDED_FOR"]));
$ip = end($parts);
}
Conclusion
The CVE-2026-55584 vulnerability in phpSysInfo poses a significant risk by allowing unauthorized access to sensitive system information through IP allowlist bypass. It is crucial to update to the patched version and implement the recommended code changes to secure your application.
See every vulnerability recorded for phpsysinfo/phpsysinfo →
FAQ
CVE-2026-55584 is a vulnerability in phpSysInfo that allows unauthorized users to bypass IP allowlist restrictions through spoofed HTTP headers.
If you are using phpSysInfo version 3.4.x or earlier, your installation is vulnerable. You can check your version in the application settings or by looking at the composer.lock file.
An attacker can access sensitive system information, including hostname, kernel version, CPU model, memory layout, mounted filesystems, and network interface addresses.
Yes, the vulnerability has been patched in phpSysInfo version 3.4.6. It is recommended to update to this version or later.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It requires only the composer.lock file for monitoring.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpsysinfo/phpsysinfo.
