{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.4.5"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpsysinfo/phpsysinfo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55584"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T18:30:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nphpSysInfo\u0027s `PSI_ALLOWED` IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in `read_config.php` derives the client IP from the attacker-controlled `X-Forwarded-For` and `Client-IP` HTTP headers **before** falling back to `REMOTE_ADDR`. An attacker can send `X-Forwarded-For: \u003can allowed IP\u003e` to impersonate a trusted address and gain full access to all exposed system information, defeating the only IP-based access restriction the application provides.\n\n## Affected component\n- File: `read_config.php`\n- Versions: all versions up to and including 3.4.x (current `main`)\n\n## Description\nWhen `PSI_ALLOWED` is configured, `read_config.php` enforces an IP allowlist. The client IP is resolved as follows:\n\n```php\nif (isset($_SERVER[\"HTTP_X_FORWARDED_FOR\"])) {\n    $ip = $_SERVER[\"HTTP_X_FORWARDED_FOR\"];\n} else {\n    if (isset($_SERVER[\"HTTP_CLIENT_IP\"])) {\n        $ip = $_SERVER[\"HTTP_CLIENT_IP\"];\n    } else {\n        $ip = $_SERVER[\"REMOTE_ADDR\"];\n    }\n}\n```\n\nBoth `HTTP_X_FORWARDED_FOR` and `HTTP_CLIENT_IP` are fully attacker-controlled request headers. They are trusted unconditionally and take priority over `REMOTE_ADDR`. There is no concept of a configured/trusted reverse proxy, so even when phpSysInfo is exposed directly (no proxy in front), the spoofed header wins. As a result the allowlist provides no real protection.\n\n## Proof of Concept\nVerified against phpSysInfo `3.4.x-main-d786ab2` running in a local Docker container (`php:8.2-apache`).\n\nDeployment with the allowlist (under `[main]`) restricted to an address the attacker does not own:\n\n```ini\n; phpsysinfo.ini  ([main] section)\nALLOWED=8.8.8.8\n```\n\nRequest without the spoofed header \u2014 correctly denied (attacker\u0027s real IP is the container gateway `172.17.0.1`):\n\n```bash\n$ curl -s http://localhost:8080/xml.php | head -c 200\nClient IP address (172.17.0.1) not allowed.\n```\n\nRequest with a spoofed `X-Forwarded-For` matching the allowlist \u2014 bypass, full system information returned:\n\n```bash\n$ curl -s -H \"X-Forwarded-For: 8.8.8.8\" http://localhost:8080/xml.php | head -c 200\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003ctns:phpsysinfo xmlns:tns=\"http://phpsysinfo.sourceforge.net/\" ...\u003e\n```\n\nThe same bypass works with the `Client-IP` header (`HTTP_CLIENT_IP`), which is also trusted before `REMOTE_ADDR`.\n\n## Impact\nAny remote, unauthenticated attacker can defeat the `PSI_ALLOWED` access restriction and read the complete system information exposed by phpSysInfo, including hostname, kernel version, CPU model, memory layout, mounted filesystems, and all network interface addresses. This information is valuable for reconnaissance and targeting of further attacks.\n\n## Remediation\nUse `REMOTE_ADDR` as the authoritative client IP by default. Only honor `X-Forwarded-For` / `Client-IP` when the request originates from an explicitly configured list of trusted proxies, and when honoring it, parse the correct entry from the chain rather than trusting the whole header. Example direction:\n\n```php\n$ip = $_SERVER[\"REMOTE_ADDR\"];\nif (defined(\u0027PSI_TRUSTED_PROXIES\u0027) \u0026\u0026 in_array($ip, $trusted_proxies, true)\n    \u0026\u0026 isset($_SERVER[\"HTTP_X_FORWARDED_FOR\"])) {\n    // take the right-most untrusted hop from the XFF chain\n    $parts = array_map(\u0027trim\u0027, explode(\u0027,\u0027, $_SERVER[\"HTTP_X_FORWARDED_FOR\"]));\n    $ip = end($parts);\n}\n```\n\n## Discovery / Credit\n- Reported by: Muhammed Mirac Kay\u0131kci\n- Coordinated disclosure; no third-party systems were tested. Verification performed against a local Docker deployment only.",
  "id": "GHSA-786w-p5pm-cvgh",
  "modified": "2026-08-28T18:30:55Z",
  "published": "2026-08-28T18:30:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phpsysinfo/phpsysinfo/security/advisories/GHSA-786w-p5pm-cvgh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phpsysinfo/phpsysinfo/commit/019fa2d7e568ea11461adb4bd33da5dc87c4b9ab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phpsysinfo/phpsysinfo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phpsysinfo/phpsysinfo/releases/tag/v3.4.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers"
}