## Summary
Apioo Fusio 8.8.3 contains a remote code execution issue (CVE-2026-72551) where an authenticated user with the Developer role can escape a PHP sandbox and execute arbitrary OS commands on the server.
## Technical Details
- The vulnerability is described as a PHP sandbox allow-list bypass.
- The sandbox allow-list permits functions that can *transitively invoke* system(), allowing sandbox escape.
- Exploitation requires an account with the Developer role; the attacker then uses the sandbox bypass to run arbitrary OS commands.
- The NVD description classifies it as remote code execution with full compromise impact.
## Affected
- Apioo Fusio 8.8.3
- Affected access context: authenticated users with the Developer role.
## Impact
- Remote code execution via OS command execution.
- Full server compromise is possible (confidentiality, integrity, and availability impact are indicated by the CVSS vector).
## Mitigation
1. Patch immediately to a fixed version of Apioo Fusio (the provided references do not include a specific fixed release number).
2. Restrict access to accounts with the Developer role to trusted operators only.
3. Review and harden any custom logic/actions that may interact with the PHP sandbox/allow-list mechanisms.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78