Fusio 7.2.1 released

CH

chriskapp

Lead Engineer

We are happy to announce the release of Fusio 7.2.1. This patch version is released earlier due to the recent remote code execution vulnerabilities s. CVE-2026-109618 and CVE-2026-109619. With this release we update our docker image to fix the issue, if you self-host Fusio we strongly encouraged to update your PHP version immediately.

The following list covers the most important changes in this release:

  • Add "search" query parameter to the SQL-Select-All action

    The action now supports a search query parameter to define more complex conditions, this query language is also already used at the backend. For example you can say column_a: foo AND column_b: bar

  • Internally reuse SQL and Filesystem actions

    Previously we had duplicated the code at the Fusio backend and in the actions to i.e. get data from a table or list files. At the backend we now extend the existing action classes which reduces duplicate code.

  • Add FTP adapter

    We have added a new FTP adapter which provides a "Ftp" connection. Internally it also uses the Flysystem so it has the same interface as the local file adapter.

  • Added Grid project

    We have introduced a new Fusio based side-project called Grid which basically helps to expose a database as REST API. Therefor you only need to run the grid:setup command and it connects to a remote DB and configures all operations, action and schemas at your Fusio instance to expose all tables as endpoint.

  • Added Pulse project

    We have introduced another Fusio based side-project called Pulse which is a notification gateway based on the Symfony Notifier components. It comes with ready to use endpoints to send chat, email, push and sms messages, you only need to configure a provider.

  • Update OpenAPI version to 3.1.2

    Internally the models and OpenAPI version was updated to the version 3.1.2.

  • Add refresh token status check

    An issue which was reported by a security researcher that it was possible to use a refresh token even if the token was not active. The refresh token lookup now includes a status active check.

  • Fix OAuth2 redirect uri host check #65

    A fix in our OAuth2 redirect uri host check which previously had allowed other domains i.e. if your app had configured a domain like http://google.com the domain http://notgoogle.com could be used, this is now fixed and only all sub-domains of a specific domain are allowed.

  • Update our docker image to fix CVE-2026-109618 and CVE-2026-109619

    We have update our docker image to the latest PHP 8.4.27 version which fixes two critical vulnerabilities that can allow unauthenticated remote code execution. All Fusio users are strongly encouraged to update immediately.

If you want to provide some feedback take a look at our GitHub discussions or issues page.

Best regards
Christoph

fusio announcement