Critical
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
Impact
This vulnerability affects applications that:
- Use the ImageMagick handler for image processing (
imagickas the image library) - AND either:
- Allow file uploads with user-controlled filenames and process uploaded images using the
resize()method - OR use the
text()method with user-controlled text content or options
- Allow file uploads with user-controlled filenames and process uploaded images using the
An attacker can:
- Upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed
- OR provide malicious text content or options that get executed when adding text to images
Patches
Upgrade to v4.6.2 or later.
Workarounds
- Switch to the GD image handler (
gd, the default handler), which is not affected by either vulnerability - For file upload scenarios: Instead of using user-provided filenames, generate random names to eliminate the attack vector with
getRandomName()when using themove()method, or use thestore()method, which automatically generates safe filenames - For text operations: If you must use ImageMagick with user-controlled text, sanitize the input to only allow safe characters:
preg_replace('/[^a-zA-Z0-9\s.,!?-]/', '', $text)and validate/restrict text options
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | codeigniter4/framework | < 4.6.2 | 4.6.2 |
References
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-9952-gv64-x94c
- https://nvd.nist.gov/vuln/detail/CVE-2025-54418
- https://github.com/codeigniter4/CodeIgniter4/commit/e18120bff1da691e1d15ffc1bf553ae7411762c0
- https://cwe.mitre.org/data/definitions/78.html
- https://github.com/codeigniter4/CodeIgniter4
- https://owasp.org/www-community/attacks/Command_Injection
CVSS score
9.8/10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-78- Platform
- Composer
- Package
codeigniter4/framework- Disclosed
- 28.07.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9952-gv64-x94c - CC BY 4.0
Vulnerability history: codeigniter4/framework
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 19
- First → latest
- 01.2022 08.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 6
- High 8
- Medium 4
- Low 1
Disclosures per year
- 2022: 9
- 2023: 2
- 2024: 1
- 2025: 2
- 2026: 5
-
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.