phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.

CVE-2026-55584 affects phpSysInfo versions prior to 3.4.6, a customizable PHP script for displaying system information. The vulnerability exists in the PSI_ALLOWED access-control check within read_config.php, which improperly trusts attacker-controlled HTTP headers X-Forwarded-For and Client-IP over the legitimate REMOTE_ADDR value. A remote unauthenticated attacker can exploit this by supplying an allowed IP address in these headers to impersonate a trusted client. Successful exploitation grants access to sensitive system information including hostname, kernel details, CPU, memory, filesystem, and network interface data. The flaw represents an IP-based authentication bypass through HTTP header manipulation. No authentication is required to exploit this vulnerability. The issue has been patched in phpSysInfo version 3.4.6. Users are advised to upgrade immediately to the fixed release.