The flaw, classified under CWE-78 (OS Command Injection), affects all CodeIgniter4 applications running versions prior to 4.6.2 that utilize the ImageMagick library for image processing operations. The vulnerability was published to the GitHub Advisory Database on July 28, 2025, and has been assigned critical severity due to its potential for complete system compromise. The vulnerability, tracked as CVE-2025-54418, received a CVSS score of 9.8, indicating the highest severity level and immediate risk to affected systems. The vulnerability manifests through two primary attack vectors within applications that use the ImageMagick handler (imagick as the image library). The second vector targets the text() method, where malicious content or options provided by users can result in command execution when adding text overlays to images. This type of vulnerability is particularly concerning because it bypasses traditional input validation mechanisms that focus on file content rather than metadata like filenames. CodeIgniter4 developers have released version 4.6.2 as an emergency patch to address this critical vulnerability. Critical vulnerability in CodeIgniter4 <4.6.2 ImageMagick handler. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates maximum impact across confidentiality, integrity, and availability.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 29 Jul 2025 14:15:15 +0000