CVE-2025-54418: CodeIgniter4 ImageMagick Handler Command Injection Vulnerability
Summary
CVE-2025-54418: CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability. Affects codeigniter4/framework versions < 4.6.2. Fixed in 4.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter4 is a powerful PHP framework designed for building web applications. It offers a rich set of libraries and tools for developers, including support for various image processing libraries. However, its ImageMagick handler, when used with user-controlled inputs, is vulnerable to command injection attacks, allowing malicious users to execute arbitrary commands on the server.
Vulnerability Detail
This vulnerability arises from the improper handling of user-controlled filenames and text inputs when using the ImageMagick handler for image processing. Attackers can exploit this by uploading files with malicious filenames containing shell metacharacters or by providing harmful text content that gets executed during image processing. The potential ramifications include unauthorized command execution, leading to data breaches or server compromise.
How To Fix
Minimum fixed version
4.6.2
This is the first release that contains the fix.
composer require codeigniter4/framework:4.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider the following workarounds: 1. Switch to the GD image handler (the default handler) which is not affected by this vulnerability. 2. For file uploads, generate random filenames using the 'getRandomName()' method when using the 'move()' method, or utilize the 'store()' method which automatically generates safe filenames. 3. For text operations, sanitize user input by allowing only safe characters using the following code: 'preg_replace('/[^a-zA-Z0-9\s.,!?-]/', '', $text)'. Validate and restrict text options accordingly.
Conclusion
The CodeIgniter4 ImageMagick handler vulnerability (CVE-2025-54418) poses a significant risk to applications that allow user-controlled inputs for image processing. It is crucial to upgrade to the patched version (4.6.2 or later) or implement the recommended workarounds to safeguard your application against potential attacks.
See every vulnerability recorded for codeigniter4/framework →
FAQ
CVE-2025-54418 is a critical vulnerability in CodeIgniter4's ImageMagick handler that allows for command injection through user-controlled inputs.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to unauthorized command execution on the server, potentially compromising sensitive data and the integrity of the application.
Implement the suggested workarounds, such as switching to the GD image handler or sanitizing user inputs to mitigate the risk until you can upgrade.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
