CVE-2025-67886

Published: May 8, 2026Modified: Jun 17, 2026

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (7)

https://dev.1c-bitrix.ru/api_help/translate/index.php

Source: cve@mitre.org

https://dev.1c-bitrix.ru/learning/course/?COURSE_ID=43&LESSON_ID=3055

Source: cve@mitre.org

https://karmainsecurity.com/pocs/CVE-2025-67886.php

Source: cve@mitre.org

https://seclists.org/fulldisclosure/2025/Dec/21

Source: cve@mitre.org

https://www.bitrix24.com/self-hosted/

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2025/Dec/21

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/fulldisclosure/2025/Dec/21

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.