CVE-2026-72551
Received Received - Intake

Remote Code Execution in Apioo Fusio via PHP-Sandbox Bypass

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system(), enabling a developer to escape the sandbox and gain OS command execution on the server. An attacker with a Developer-role account can achieve full server compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72551
EUVD
EUVD-2026-56021

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apioo fusio 8.8.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a remote code execution vulnerability in Apioo Fusio 8.8.3. Authenticated users with the Developer role can bypass a PHP sandbox allow-list to execute arbitrary OS commands. The sandbox normally restricts dangerous functions, but it permits some that indirectly call system(), allowing attackers to escape the sandbox and fully compromise the server.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized OS command execution attempts or suspicious PHP-Sandbox bypass activities. Monitor server logs for unexpected system() function calls or unusual developer-role account actions. Check Fusio's Action configurations for unauthorized PHP classes invoking shell commands.

Impact Analysis

If you use Apioo Fusio 8.8.3 and have a Developer-role account, an attacker could gain full control of your server. This includes executing any command, accessing sensitive data, or disrupting services. Even if you don't have a Developer account, an insider threat or compromised account could exploit this.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules. A breach may result in legal penalties, loss of customer trust, and regulatory fines due to compromised personal or health information.

Mitigation Strategies

Immediately revoke Developer-role privileges from untrusted users. Update Fusio to the latest patched version if available. Review and restrict PHP-Sandbox allow-list to prevent system() function invocation. Monitor server logs for signs of exploitation and isolate affected systems if compromise is suspected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72551. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart