EUVD-2026-56021
GHSA-j2qp-grc7-qcqj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible sandbox reachable post-authentication; PR:L because Developer-role account is required but is a low-privilege role, not admin; full C/I/A impact from OS command execution.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system(), enabling a developer to escape the sandbox and gain OS command execution on the server. An attacker with a Developer-role account can achieve full server compromise.
AnalysisAI
Remote code execution in Fusio 8.8.3 allows authenticated Developer-role users to escape the PHP-Sandbox and execute arbitrary OS commands on the server. The root cause is a CWE-78 OS Command Injection flaw: the sandbox allow-list permits PHP functions that transitively invoke system(), enabling full sandbox escape. With a valid Developer-role account, an attacker can achieve complete server compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and network accessibility elevate priority for any Fusio deployment where Developer accounts are granted to untrusted parties.
Technical ContextAI
Fusio is an open-source API management and low-code platform built on PHP, developed by Apioo. It provides a PHP-Sandbox feature allowing Developer-role users to write and execute custom PHP logic within a controlled environment. The sandbox enforces an allow-list of permitted PHP functions intended to prevent dangerous OS-level calls. However, the allow-list fails to account for transitive function chains - permitted PHP functions that internally delegate to system() or equivalent OS-execution calls. This constitutes a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw at the sandbox enforcement layer. The CPE string cpe:2.3:a:apioo:fusio:*:*:*:*:*:*:*:* and EUVD-2026-56021 data confirm all Fusio versions from 0 through 8.8.3 are affected.
RemediationAI
No explicitly confirmed patched version was available in the provided reference data; consumers should monitor https://github.com/apioo/fusio for a release beyond 8.8.3 that addresses the PHP-Sandbox allow-list bypass. As the primary compensating control, restrict assignment of the Developer role exclusively to fully trusted, internally accountable users - eliminating untrusted or external Developer-role accounts eliminates the attack surface entirely. Additionally, review and harden the PHP-Sandbox allow-list to exclude any functions capable of transitively invoking system(), exec(), passthru(), shell_exec(), or popen(); note that this requires deep PHP internals knowledge and incomplete enumeration may leave residual risk. Network-level controls such as placing the Fusio instance behind an authenticated proxy or WAF with restricted access can reduce exposure but do not remediate the underlying flaw. If the sandbox feature is not required operationally, disabling PHP code execution capabilities for Developer-role users is the most effective interim workaround.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today