CVE-2026-72551 in Fusio
Summary
by MITRE • 08/11/2026
A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system(), enabling a developer to escape the sandbox and gain OS command execution on the server. An attacker with a Developer-role account can achieve full server compromise.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical remote code execution flaw in Apioo Fusio version 8.8.3 that demonstrates a fundamental failure in sandbox security implementation. The issue stems from an insufficiently restrictive PHP sandbox mechanism that allows authenticated users with the Developer role to bypass intended security boundaries. The vulnerability operates through a transitive function call chain where permitted functions ultimately invoke system() or similar low-level operating system interfaces, creating an unexpected escape route from the controlled execution environment.
The technical exploitation relies on the improper design of the allow-list mechanism within the PHP sandbox implementation. When developers with appropriate privileges attempt to use certain allowed functions, these functions contain internal calls that ultimately lead to system command execution capabilities. This represents a classic sandbox bypass pattern where the security model fails to account for indirect code paths that may exist within the allowed function implementations. The vulnerability directly maps to CWE-94 - Improper Control of Generation of Code ('Code Injection') and CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
From an operational perspective, this vulnerability creates a severe compromise scenario where attackers with minimal privileges can achieve complete server control. The Developer role typically provides access to application development features but should not include system-level command execution capabilities. Once exploited, the attacker gains full control over the underlying operating system, potentially leading to data exfiltration, persistence mechanisms, privilege escalation to other users, and further network infiltration. This vulnerability effectively undermines the principle of least privilege and demonstrates a critical gap in the application's security architecture.
The mitigation strategy requires immediate implementation of a comprehensive sandbox redesign that properly isolates function calls and prevents transitive system command execution. Organizations should implement strict input validation and output encoding for all developer-facing interfaces, while also considering more robust sandboxing solutions such as PHP with restricted extensions or containerized execution environments. Additionally, privilege escalation controls must be enforced to ensure that user roles cannot access functionality beyond their intended scope. This vulnerability highlights the importance of proper security review processes during development and the necessity of comprehensive testing for sandboxed environments. The remediation approach should align with ATT&CK tactic T1059 - Command and Scripting Interpreter, emphasizing the need for strict enforcement of execution boundaries to prevent unauthorized system command invocation.