Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Fri, 08 May 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Bitrix24 Remote Code Execution via Translate Module Upload | |
| Weaknesses | CWE-285 CWE-94 |
Fri, 08 May 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 08 May 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-05-08T05:52:25.556Z
Reserved: 2025-12-12T00:00:00.000Z
Link: CVE-2025-67886
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-08T07:16:28.180
Modified: 2026-05-08T07:16:28.180
Link: CVE-2025-67886
Redhat
No data.