CVE-2026-55584

phpSysInfo versions prior to 3.4.6 contain an authentication/access-control flaw (CWE-290) in read_config.php: the PSI_ALLOWED client allowlist check trusts the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote, unauthenticated attacker can therefore send a request with one of these headers set to an allowed address and be treated as a trusted client. Successful exploitation is an information disclosure, exposing the system data phpSysInfo renders, including hostname, kernel, CPU, memory, filesystem, and network-interface details. Any phpSysInfo deployment below 3.4.6 carries the flawed code, but the bypass is most consequential where administrators relied on PSI_ALLOWED to restrict access, since instances without that restriction already expose this information to anyone who can reach the page. No public proof-of-concept is known, the issue is not in CISA's KEV, and exploitation has not been observed in the wild, though EPSS assigns a 2.4% probability (83rd percentile) of exploitation within 30 days.

What to do: Upgrade to phpSysInfo 3.4.6 or later. Until patched, enforce access restrictions at the web-server or network layer (source-IP allowlists, VPN, or reverse proxy controls) instead of relying on PSI_ALLOWED, since the header-based check can be spoofed. Audit for internet-exposed phpSysInfo instances and review access logs for requests carrying X-Forwarded-For or Client-IP headers set to allowed addresses.