high · 7.5CVE-2026-55584Aug 28, 2026

CVE-2026-55584: phpSysInfo IP Allowlist Bypass via Spoofed Headers

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Any remote attacker can bypass phpSysInfo's IP-based access restriction by faking a trusted address in the X-Forwarded-For or Client-IP HTTP header, exposing full system information to the internet.

Packagephpsysinfo/phpsysinfo
Ecosystemcomposer
Affected<= 3.4.5
Fixed in3.4.6
CVE-2026-55584: phpSysInfo IP Allowlist Bypass via Spoofed Headers

The problem

phpSysInfo lets administrators restrict access via the PSI_ALLOWED IP allowlist in phpsysinfo.ini. The check lives in read_config.php and derives the client IP by reading HTTP_X_FORWARDED_FOR first, then HTTP_CLIENT_IP, and only falling back to REMOTE_ADDR if neither header is present.

Both proxy headers are fully attacker-controlled. Because there is no trusted-proxy concept, the spoofed header wins unconditionally, even when phpSysInfo is exposed directly to the internet with no proxy in front of it. The allowlist provides zero real protection.

Proof of concept

A working proof-of-concept for CVE-2026-55584 in phpsysinfo/phpsysinfo, with the exact payload below.

bash
# Replace <ALLOWED_IP> with any address in the PSI_ALLOWED list.
# Works against xml.php (XML output) and index.php alike.

# Bypass via X-Forwarded-For:
curl -s -H "X-Forwarded-For: <ALLOWED_IP>" http://target/xml.php

# Bypass via Client-IP:
curl -s -H "Client-IP: <ALLOWED_IP>" http://target/xml.php

The root cause is unconditional trust of attacker-supplied headers (CWE-290). The vulnerable block in read_config.php checks HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP before REMOTE_ADDR with no validation of whether the request actually came through a trusted proxy.

The patch (commit 019fa2d) removes this header-priority logic and makes REMOTE_ADDR the authoritative source by default. Proxy headers are only honored when the connecting IP is in an explicit PSI_TRUSTED_PROXIES list, and even then only the rightmost untrusted hop in the XFF chain is used, preventing chain-injection attacks.

The fix

Upgrade to phpSysInfo 3.4.6 (released 2026-06-19, commit 019fa2d7e568ea11461adb4bd33da5dc87c4b9ab). The fix makes REMOTE_ADDR authoritative; proxy headers are only trusted when the request comes from a configured PSI_TRUSTED_PROXIES address. If you cannot upgrade immediately, block public access to phpSysInfo at the network or web-server level rather than relying on PSI_ALLOWED alone.

Reported by Muhammed Mirac Kayıkci.

References: [1][2][3][4]

Related research