CVE-2025-67887

Published: May 8, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (7)

https://dev.1c-bitrix.ru/api_help/translate/index.php

Source: cve@mitre.org

https://dev.1c-bitrix.ru/learning/course/?COURSE_ID=43&LESSON_ID=3055

Source: cve@mitre.org

https://karmainsecurity.com/pocs/CVE-2025-67887.php

Source: cve@mitre.org

https://seclists.org/fulldisclosure/2025/Dec/22

Source: cve@mitre.org

https://www.1c-bitrix.ru/support/index.php

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2025/Dec/22

Source: af854a3a-2127-422b-91ae-364da2661108

https://karmainsecurity.com/pocs/CVE-2025-67887.php

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.