CVE-2026-55584: phpSysInfo Authentication Bypass Vulnerability

CVE-2026-55584 Overview

CVE-2026-55584 is an authentication bypass vulnerability in phpSysInfo, a customizable PHP script that displays system information. Versions prior to 3.4.6 trust attacker-controlled X-Forwarded-For and Client-IP HTTP headers in the PSI_ALLOWED access-control check inside read_config.php. The check evaluates these headers before falling back to REMOTE_ADDR, letting a remote unauthenticated attacker spoof a trusted client address. Successful exploitation exposes hostname, kernel version, CPU, memory, filesystem, and network-interface information. The issue is fixed in version 3.4.6 [CWE-290].

Critical Impact
Unauthenticated remote attackers can bypass IP allowlists by supplying a forged HTTP header, exposing detailed host reconnaissance data useful for follow-on attacks.

Affected Products

phpSysInfo versions prior to 3.4.6
Deployments relying on PSI_ALLOWED IP allowlisting for access control
Web servers exposing phpSysInfo behind proxies or directly on the network

Discovery Timeline

2026-08-28 - CVE-2026-55584 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55584

Vulnerability Analysis

phpSysInfo enforces client access restrictions through the PSI_ALLOWED directive processed in read_config.php. The access-control logic inspects X-Forwarded-For and Client-IP HTTP headers to determine the client's source address before consulting the transport-layer REMOTE_ADDR value. Because both headers are attacker-supplied and unauthenticated, a remote client can inject an address that matches the allowlist and satisfy the check.

Once the check passes, phpSysInfo renders the full information page that the operator intended to restrict. The exposed data includes hostname, running kernel version, CPU model and load, memory usage, mounted filesystems, and configured network interfaces. This telemetry provides reconnaissance value for attackers targeting the host or adjacent infrastructure.

The weakness is classified as Authentication Bypass by Spoofing [CWE-290]. The vulnerability is exposed over the network with no authentication or user interaction required, and it impacts confidentiality only — no data can be modified through this path.

Root Cause

The root cause is misplaced trust in HTTP request headers that any client can set. The access-control logic prefers proxy-forwarding headers over the actual TCP peer address, inverting the expected trust order. Applications should only honor X-Forwarded-For when placed behind a known reverse proxy and after validating the immediate peer.

Attack Vector

An unauthenticated attacker sends an HTTP request to the phpSysInfo endpoint and adds a header such as X-Forwarded-For: 127.0.0.1 or Client-IP: <allowlisted-address>. The PSI_ALLOWED check reads the spoofed header, treats the request as originating from a trusted source, and returns the full system information page. See the GitHub Security Advisory GHSA-786w-p5pm-cvgh for additional detail.

// Exploitation is described in prose only; no verified PoC code is included.
// See the advisory and patch commit for technical specifics:
// https://github.com/phpsysinfo/phpsysinfo/commit/019fa2d7e568ea11461adb4bd33da5dc87c4b9ab

Detection Methods for CVE-2026-55584

Indicators of Compromise

HTTP requests to phpSysInfo URLs containing X-Forwarded-For or Client-IP headers set to loopback or internal RFC1918 addresses from external sources.
Access logs showing successful 200 OK responses to index.php or xml.php from clients that should be blocked by PSI_ALLOWED.
Repeated requests from a single external IP with varying spoofed forwarding headers, indicating enumeration attempts.

Detection Strategies

Inspect web server access logs for requests where the X-Forwarded-For header value does not match the reverse proxy's known egress addresses.
Deploy web application firewall (WAF) rules that strip or normalize X-Forwarded-For and Client-IP headers at the perimeter before requests reach phpSysInfo.
Correlate phpSysInfo request patterns with reconnaissance signatures such as subsequent scans against exposed services identified in the returned system data.

Monitoring Recommendations

Alert on any external client successfully retrieving phpSysInfo output when the deployment is intended for internal use only.
Monitor for spikes in requests to index.php and xml.php endpoints under the phpSysInfo install path.
Track outbound reconnaissance from hosts that recently served phpSysInfo responses, which may indicate follow-on activity.

How to Mitigate CVE-2026-55584

Immediate Actions Required

Upgrade phpSysInfo to version 3.4.6 or later immediately using the v3.4.6 release.
Restrict access to phpSysInfo at the web server or network layer using Allow/Deny directives that evaluate the actual TCP peer address.
Require authentication in front of phpSysInfo using HTTP basic auth or a reverse-proxy SSO gateway.

Patch Information

The fix is delivered in phpSysInfo 3.4.6. The patch commit 019fa2d modifies read_config.php so the PSI_ALLOWED check no longer trusts X-Forwarded-For or Client-IP headers ahead of REMOTE_ADDR. Review the GitHub Security Advisory for full remediation guidance.

Workarounds

Configure the web server or reverse proxy to unset X-Forwarded-For and Client-IP headers on inbound requests to phpSysInfo.
Enforce network-layer allowlisting via firewall rules rather than relying on PSI_ALLOWED for access control.
Remove or disable the phpSysInfo installation until the patched version can be deployed.

bash

# Apache example: strip attacker-controlled forwarding headers before phpSysInfo processes them
<Location "/phpsysinfo">
    RequestHeader unset X-Forwarded-For
    RequestHeader unset Client-IP
    Require ip 10.0.0.0/8 192.168.0.0/16
</Location>