Fusio
Monthly
Remote code execution in Fusio 8.8.3 allows authenticated Developer-role users to escape the PHP-Sandbox and execute arbitrary OS commands on the server. The root cause is a CWE-78 OS Command Injection flaw: the sandbox allow-list permits PHP functions that transitively invoke system(), enabling full sandbox escape. With a valid Developer-role account, an attacker can achieve complete server compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and network accessibility elevate priority for any Fusio deployment where Developer accounts are granted to untrusted parties.
Server-side request forgery in Apioo Fusio 8.8.3 enables authenticated consumer-role users to direct the application server to issue arbitrary HTTP POST requests to internal network addresses by registering a crafted webhook URL. The root cause is insufficient input validation: the webhook registration endpoint applies PHP's FILTER_VALIDATE_URL for syntactic URL checking but enforces no IP or host denylist to block private RFC 1918 ranges, loopback, or link-local addresses. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Remote code execution in Fusio 8.8.3 allows authenticated Developer-role users to escape the PHP-Sandbox and execute arbitrary OS commands on the server. The root cause is a CWE-78 OS Command Injection flaw: the sandbox allow-list permits PHP functions that transitively invoke system(), enabling full sandbox escape. With a valid Developer-role account, an attacker can achieve complete server compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and network accessibility elevate priority for any Fusio deployment where Developer accounts are granted to untrusted parties.
Server-side request forgery in Apioo Fusio 8.8.3 enables authenticated consumer-role users to direct the application server to issue arbitrary HTTP POST requests to internal network addresses by registering a crafted webhook URL. The root cause is insufficient input validation: the webhook registration endpoint applies PHP's FILTER_VALIDATE_URL for syntactic URL checking but enforces no IP or host denylist to block private RFC 1918 ranges, loopback, or link-local addresses. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.