CVE-2025-67886 | THREATINT

Description

Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.

PUBLISHED Reserved 2025-12-12 | Published 2026-05-08 | Updated 2026-05-08 | Assigner mitre

References

seclists.org/fulldisclosure/2025/Dec/21

seclists.org/fulldisclosure/2025/Dec/21 exploit

www.bitrix24.com/self-hosted/

seclists.org/fulldisclosure/2025/Dec/21

karmainsecurity.com/pocs/CVE-2025-67886.php

dev.1c-bitrix.ru/...ning/course/?COURSE_ID=43&LESSON_ID=3055

dev.1c-bitrix.ru/api_help/translate/index.php

cve.org (CVE-2025-67886)

nvd.nist.gov (CVE-2025-67886)

Download JSON