{"action":"Upgrade phpsysinfo/phpsysinfo to 3.4.6 or later.","affected":[{"fixed":"3.4.6","introduced":"0"}],"component":"phpsysinfo/phpsysinfo","cve_ids":["CVE-2026-55584"],"ecosystem":"Packagist","epss":0.0191,"exploited":false,"fixed_versions":["3.4.6"],"ghsa_id":"GHSA-786w-p5pm-cvgh","id":"tcs_01M5KEXTTS754Y2XW5YEVE5EW0","modified_at":"2026-08-28T18:55:36.138544Z","published_at":"2026-08-28T18:30:55Z","references":["https://osv.dev/vulnerability/GHSA-786w-p5pm-cvgh","https://github.com/phpsysinfo/phpsysinfo/security/advisories/GHSA-786w-p5pm-cvgh","https://github.com/phpsysinfo/phpsysinfo/commit/019fa2d7e568ea11461adb4bd33da5dc87c4b9ab","https://github.com/phpsysinfo/phpsysinfo","https://github.com/phpsysinfo/phpsysinfo/releases/tag/v3.4.6"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-786w-p5pm-cvgh","url":"https://osv.dev/vulnerability/GHSA-786w-p5pm-cvgh"}],"summary":"phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers"}