OS Command Injection in CodeIgniter4 - CVE-2025-54418
Published: May 23, 2026
Vulnerability identifier: #VU132172
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-54418
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in the ImageMagick handler when processing uploaded images with user-controlled filenames via the resize() method or adding text to images with user-controlled text content or options via the text() method. A remote attacker can supply crafted filenames, text content, or text options to execute arbitrary commands.
Only applications using the imagick image library are affected.
Affected software
CodeIgniter4
How to mitigate CVE-2025-54418
Install security update from vendor's website.
CodeIgniter4 - update to 4.6.2