9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54418

CVE-2025-54418: CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

Impact

This vulnerability affects applications that:

Use the ImageMagick handler for image processing (imagick as the image library)
AND either:
- Allow file uploads with user-controlled filenames and process uploaded images using the resize() method
- OR use the text() method with user-controlled text content or options

An attacker can:

Upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed
OR provide malicious text content or options that get executed when adding text to images

Patches

Upgrade to v4.6.2 or later.

Workarounds

Switch to the GD image handler (gd, the default handler), which is not affected by either vulnerability
For file upload scenarios: Instead of using user-provided filenames, generate random names to eliminate the attack vector with getRandomName() when using the move() method, or use the store() method, which automatically generates safe filenames
For text operations: If you must use ImageMagick with user-controlled text, sanitize the input to only allow safe characters: preg_replace('/[^a-zA-Z0-9\s.,!?-]/', '', $text) and validate/restrict text options

References

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54418

CVE-2025-54418:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
codeigniter4/framework	composer	< 4.6.2	4.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the ImageMagickHandler class of CodeIgniter4, specifically within the _resize and _text methods. These methods are responsible for processing images using the ImageMagick command-line tool. The core of the vulnerability is the improper construction of shell commands, where user-controlled input (filenames in _resize, and text or options in _text) was directly concatenated into the command string without sufficient sanitization. This allowed for OS command injection.

The analysis of the patch e18120bff1da691e1d15ffc1bf553ae7411762c0 clearly shows the remediation. In both _resize and _text methods, the patch replaces direct string concatenation with the escapeshellarg() function. This function is a standard security measure in PHP to ensure that a string is passed as a single, safe argument to a shell command, effectively neutralizing any malicious shell metacharacters.

Therefore, any application using the ImageMagick handler in CodeIgniter4 before version 4.6.2 is vulnerable. When a user uploads a file with a crafted filename and the resize() method is called, or when the text() method is used with malicious input, the _resize or _text functions would be present in the runtime profile, executing the injected command.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.