Executive brief
Apioo Fusio is a self-hosted API management platform that allows developers to build and manage APIs. An authenticated user with Developer role can bypass the platform's PHP code sandbox and execute arbitrary operating system commands, potentially compromising the entire server. This requires prior authentication and a valid developer account, but allows an insider threat or compromised account to fully compromise the hosting infrastructure.
Technical details
The vulnerability is a sandbox bypass in Apioo Fusio 8.8.3 that exploits improper allow-listing of PHP functions. The sandbox is designed to prevent execution of dangerous OS-level commands, but the allow-list permits functions that transitively call system() or equivalent functions. An authenticated attacker with Developer role can chain these allow-listed functions to escape the sandbox and execute arbitrary OS commands on the server with the privileges of the PHP process. The vulnerability is in the PHP execution engine used by Fusio for running developer code. No patch details are currently available.
Affected products
- Apioo Fusio 8.8.3
Timeline
- 2026-08-11: disclosed