Command Injection Vulnerability in CodeIgniter Framework Affecting Image Processing

CVE-2025-54418

What is CVE-2025-54418?

A command injection flaw exists in the CodeIgniter framework, impacting versions before 4.6.2. This vulnerability particularly affects applications that utilize the ImageMagick handler (imagick) for image processing. It allows attackers to manipulate file uploads by providing filenames containing shell metacharacters or controlling text input/options during image text rendering. If exploited, an attacker can execute arbitrary commands on the server. Users are encouraged to upgrade to version 4.6.2 or later to mitigate this risk. As an interim solution, switching to the GD image handler and implementing safe filename generation or input sanitization can significantly reduce the threat.

References