CVE-2026-103592
simple-router: simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers
pecee simple-routerNetwork & edge
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to impersonate whitelisted addresses or evade blacklists, gaining access to IP-restricted routes.
Text from CVE List
Affected versions 1
- simple-routeraffected: all versions through 5.4.1.7CVE List
References 5
- vulncheck.com/advisories/simple-php-router-through-5.4.1.7-ip-restriction-bypass-via-forwarding-headersAdvisoryvia CVE List
- github.com/skipperbent/simple-php-router/issues/727Referencevia CVE List
- github.com/skipperbent/simple-php-router/blob/5.4.1.7/src/Pecee/Http/Middleware/IpRestrictAccess.phpReferencevia CVE List
- github.com/skipperbent/simple-php-router/blob/5.4.1.7/src/Pecee/Http/Request.phpReferencevia CVE List
- github.com/skipperbent/simple-php-routerReferencevia CVE List