{"id":"CVE-2025-54418","aliases":["GHSA-9952-gv64-x94c"],"url":"https://o3.security/vulnerability/CVE-2025-54418","summary":"CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability","details":"### Impact\nThis vulnerability affects applications that:\n* Use the ImageMagick handler for image processing (`imagick` as the image library)\n* **AND** either:\n  * Allow file uploads with user-controlled filenames and process uploaded images using the `resize()` method\n  * **OR** use the `text()` method with user-controlled text content or options\n\nAn attacker can:\n* Upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed\n* **OR** provide malicious text content or options that get executed when adding text to images\n\n### Patches\nUpgrade to v4.6.2 or later.\n\n### Workarounds\n* **Switch to the GD image handler** (`gd`, the default handler), which is not affected by either vulnerability\n* **For file upload scenarios**: Instead of using user-provided filenames, generate random names to eliminate the attack vector with `getRandomName()` when using the `move()` method, or use the `store()` method, which automatically generates safe filenames\n* **For text operations**: If you must use ImageMagick with user-controlled text, sanitize the input to only allow safe characters: `preg_replace('/[^a-zA-Z0-9\\s.,!?-]/', '', $text)` and validate/restrict text options\n\n\n### References\n* [OWASP Command Injection Prevention](https://owasp.org/www-community/attacks/Command_Injection)\n* [CWE-78: OS Command Injection](https://cwe.mitre.org/data/definitions/78.html)","published":"2025-07-28T14:47:20.887Z","modified":"2026-08-12T03:51:16.809287978Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.01495,"percentile":0.7172,"asOf":"2026-08-09"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"codeigniter4/framework","fixedVersion":"4.6.2"}],"fix":{"url":"https://github.com/codeigniter4/CodeIgniter4/commit/e18120bff1da691e1d15ffc1bf553ae7411762c0","label":"codeigniter4/CodeIgniter4@e18120b"},"references":[{"type":"WEB","url":"https://cwe.mitre.org/data/definitions/78.html"},{"type":"WEB","url":"https://owasp.org/www-community/attacks/Command_Injection"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54418.json"},{"type":"ADVISORY","url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-9952-gv64-x94c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54418"},{"type":"FIX","url":"https://github.com/codeigniter4/CodeIgniter4/commit/e18120bff1da691e1d15ffc1bf553ae7411762c0"},{"type":"PACKAGE","url":"https://github.com/codeigniter4/CodeIgniter4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:16.809287978Z"}}