PT-2025-31111 · Unknown · Imagemagick+1

Vicevirus

·

Published

2025-07-26

·

Updated

2025-08-05

·

CVE-2025-54418

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.6.2
Description CodeIgniter is a PHP full-stack web framework susceptible to a command injection issue. The vulnerability impacts applications utilizing the ImageMagick handler (imagick) for image processing and either permitting file uploads with user-defined filenames processed via the resize() method or employing the text() method with user-controlled text or options. An attacker can exploit this by uploading a file with a malicious filename containing shell metacharacters, which are executed during image processing, or by providing malicious text content or options that are executed when adding text to images. Approximately 2,254,632 systems are potentially affected worldwide.
Recommendations Upgrade to version 4.6.2 or later to receive a patch. As a workaround, switch to the GD image handler (gd), which is not affected. For file upload scenarios, generate random filenames using getRandomName() with the move() method, or use the store() method, which automatically generates safe filenames. For text operations, sanitize user-controlled text input to allow only safe characters and validate/restrict text options.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

Related Identifiers

BDU:2025-09184
CVE-2025-54418
GHSA-9952-GV64-X94C

Affected Products

Codeigniter
Imagemagick