Critical command injection flaw reported in CodeIgniter4 ImageMagick handler

CodeIgniter4 has patched a critical command injection vulnerability in its ImageMagick image processing handler that could allow unauthenticated attackers to execute arbitrary system commands on affected web applications through malicious file uploads and text processing operations.

The vulnerability is tracked as CVE-2025-54418 (CVSS score 10.0) and is caused by insufficient input sanitization in CodeIgniter4's ImageMagick integration. The vulnerability occurs when applications allow file uploads with user-controlled filenames and process uploaded images using the resize() method, or when using the text() method with user-controlled text content or options.

• The first attack vector involves uploading files with filenames containing shell metacharacters that get executed when the application processes images using CodeIgniter's resize() method. During image processing operations, these malicious filenames break out of the intended ImageMagick command context and execute arbitrary shell commands on the underlying server with the same privileges as the web server process.
• The second attack path exploits the text() method when user-controlled content or options are passed for adding text overlays to images. Attackers can provide malicious text content or options that get executed when the application attempts to add text to images through ImageMagick operations.

The flaw affects all CodeIgniter4 applications running versions prior to 4.6.2 that use the ImageMagick library for image processing operations.

CodeIgniter4 developers have released version 4.6.2 as an emergency patch.

For environments where immediate patching is not feasible, several effective workarounds are available to reduce risk exposure: 

• switching from the ImageMagick handler to the GD image handler (gd), which is CodeIgniter4's default image processing library and remains completely unaffected by this vulnerability.
• implementing filename generation controls like CodeIgniter's getRandomName() method when utilizing the move() method for file uploads, or switch to the store() method, which automatically generates safe, random filenames that eliminate the attack vector entirely.
• input sanitization using regular expressions such as preg_replace('/[^a-zA-Z0-9\s.,!?-]/', '', $text) to remove potentially dangerous characters.