{"id":"CVE-2026-55584","title":"phpSysInfo is a customizable PHP script that displays system information","summary":"phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-290"],"vendor":"phpsysinfo","product":"phpsysinfo/phpsysinfo","affected":["phpsysinfo/phpsysinfo <= 3.4.5"],"patched":["phpsysinfo/phpsysinfo 3.4.6"],"published":"2026-08-28","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55584","references":[{"url":"https://github.com/phpsysinfo/phpsysinfo/commit/019fa2d7e568ea11461adb4bd33da5dc87c4b9ab","label":"security-advisories@github.com"},{"url":"https://github.com/phpsysinfo/phpsysinfo/releases/tag/v3.4.6","label":"security-advisories@github.com"},{"url":"https://github.com/phpsysinfo/phpsysinfo/security/advisories/GHSA-786w-p5pm-cvgh","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-786w-p5pm-cvgh"}],"tags":["nvd","exploit-available","ghsa","composer"],"epss":0.02417,"epssPercentile":0.83449,"exploits":{"exploitdb":true,"github":1,"githubRepos":["https://github.com/mirackayikci/CVE-2026-55584"],"checkedAt":"2026-09-24T07:53:08.280Z"},"exploitAvailable":true,"aliases":["GHSA-786w-p5pm-cvgh"],"ecosystem":"composer","ingestedAt":"2026-08-28T19:24:19.489Z","slug":"CVE-2026-55584","body":"## Overview\n\nphpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55584)\n\nAffected packages:\n\n- `phpsysinfo/phpsysinfo <= 3.4.5`\n\nPatched in:\n\n- `phpsysinfo/phpsysinfo 3.4.6`\n\nSource: https://github.com/advisories/GHSA-786w-p5pm-cvgh","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[]}