CVE-2026-72551: Apioo Fusio 8.8.3 RCE Vulnerability

CVE-2026-72551 Overview

CVE-2026-72551 is a remote code execution vulnerability in Apioo Fusio version 8.8.3. The flaw stems from a PHP-Sandbox allow-list bypass that permits functions transitively invoking system(). Authenticated users holding the Developer role can escape the sandbox and execute arbitrary operating system commands on the underlying server. Successful exploitation results in full server compromise. The vulnerability is tracked under CWE-78: OS Command Injection.

Critical Impact
An authenticated attacker with a Developer-role account can achieve arbitrary OS command execution and gain full control of the Fusio host.

Affected Products

Apioo Fusio 8.8.3
Fusio deployments exposing the Developer role to untrusted users
Self-hosted Fusio instances relying on the built-in PHP-Sandbox allow-list

Discovery Timeline

2026-08-11 - CVE CVE-2026-72551 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72551

Vulnerability Analysis

Fusio uses a PHP-Sandbox to constrain code that developers can supply through action definitions. The sandbox enforces an allow-list of PHP functions considered safe for execution. The allow-list, however, includes functions that internally call or chain into system() and related process-execution primitives. An authenticated Developer can craft PHP payloads that stay syntactically within the allow-list yet reach OS command execution at runtime. This transitively delivered command execution defeats the sandbox boundary entirely.

Root Cause

The underlying weakness is an incomplete deny model in the sandbox allow-list. Allow-listed functions are treated as terminal, but several of them invoke process-execution APIs internally or accept callables that resolve to dangerous functions. Because the sandbox validates surface-level function names rather than downstream call graphs, the isolation guarantee does not hold. The result is OS command injection through legitimate PHP APIs, mapped to CWE-78.

Attack Vector

Exploitation requires network access to the Fusio administrative interface and valid credentials for an account with the Developer role. The attacker submits a PHP action through Fusio's developer tooling that leverages an allow-listed function to reach process execution. When Fusio evaluates the action, the sandbox permits the call and the process spawns under the web server's user context. From that point the attacker can read secrets, pivot into internal networks, or install persistent implants. Refer to the Fusio project repository for component context.

Detection Methods for CVE-2026-72551

Indicators of Compromise

Unexpected child processes spawned by the PHP-FPM or web server process serving Fusio, especially shells such as sh, bash, or cmd.exe.
New or modified action definitions authored by Developer-role accounts referencing PHP functions that can chain into process execution.
Outbound network connections from the Fusio host to unfamiliar IPs shortly after Developer-role activity.

Detection Strategies

Audit Fusio action creation and update events, correlating them with the authenticated user role and source IP.
Alert on PHP interpreter processes invoking execve for shell binaries on hosts running Fusio.
Monitor filesystem writes to web-accessible directories originating from the PHP worker process.

Monitoring Recommendations

Forward Fusio application logs and web server access logs to a centralized analytics platform for correlation.
Track authentication events for Developer-role accounts and flag credential use from new geolocations or devices.
Baseline normal process ancestry for the Fusio host and alert on deviations involving command interpreters.

How to Mitigate CVE-2026-72551

Immediate Actions Required

Restrict the Developer role to trusted internal users only and remove it from accounts that do not require action authoring.
Place the Fusio administrative interface behind a VPN or IP allow-list until an official patch is applied.
Rotate credentials, API keys, and secrets accessible to the Fusio host if compromise is suspected.

Patch Information

At the time of publication, no fixed version is enumerated in the NVD entry. Monitor the Apioo Fusio GitHub repository for releases addressing the sandbox allow-list bypass and upgrade as soon as a patched version becomes available.

Workarounds

Run Fusio under a dedicated low-privilege system account with no shell and restricted filesystem permissions.
Deploy Fusio inside a container or sandbox that blocks outbound network egress and denies execution of shell binaries.
Enforce multi-factor authentication for all administrative and Developer-role logins to reduce account-takeover risk.

bash

# Example: restrict PHP-FPM from spawning shell binaries via AppArmor
# /etc/apparmor.d/local/php-fpm
deny /bin/sh mrix,
deny /bin/bash mrix,
deny /usr/bin/env mrix,
deny /usr/bin/perl mrix,
deny /usr/bin/python* mrix,