Warning: Command Injection Vulnerability in CodeIgniter4 ImageMagick Handler, Patch Immediately!

CodeIgniter4 has a critical command‑injection/RCE vulnerability (CVE-2025-54418, CVSS 9.8) in its ImageManipulation component when the non-default ImageMagick handler is used; attackers can execute OS commands via unsanitized user-controlled filenames during uploads or via unvalidated text overlay inputs. The advisory recommends urgent patching, applying listed mitigations if immediate patching is not possible, and increasing monitoring and detection; no evidence of in‑the‑wild exploitation has been reported.