CVE-2026-55584
1 advisory.
Packagist/phpsysinfo/phpsysinfo CVE-2026-55584: high 7.5, EPSS 1.91%
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
Action: Upgrade phpsysinfo/phpsysinfo to 3.4.6 or later.
composer require phpsysinfo/phpsysinfo:3.4.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.6 | - |
Fixed versions
| 3.4.6 |
Sources
- osv: GHSA-786w-p5pm-cvgh
- https://github.com/phpsysinfo/phpsysinfo/security/advisories/GHSA-786w-p5pm-cvgh
- https://github.com/phpsysinfo/phpsysinfo/commit/019fa2d7e568ea11461adb4bd33da5dc87c4b9ab
- https://github.com/phpsysinfo/phpsysinfo
- https://github.com/phpsysinfo/phpsysinfo/releases/tag/v3.4.6
CVE-2026-55584 · published · modified · JSON