CVE-2025-67886 Bitrix24 CVE debrief

Who should care

Defenders who manage Bitrix24 installations, especially those with high-privileged users who have SOURCE/WRITE permissions for the Translate Module, should assess their exposure to this vulnerability. They should verify the presence of this vulnerability in their installations and implement necessary security measures to prevent code execution.

Why it matters

CVE-2025-67886 is a Remote Code Execution vulnerability in Bitrix24 through version 25.100.300. Defenders should verify the presence of this vulnerability in their installations, especially if high-privileged users have SOURCE/WRITE permissions for the Translate Module. The Supplier disputes this as it is intended behavior for high-privileged users who can upload new translated pages to the website.

• Defenders need to verify the presence of this vulnerability in their Bitrix24 installations.
• High-privileged users with SOURCE/WRITE permissions for the Translate Module may be able to upload and execute malicious code.
• Defenders should monitor for suspicious uploads or executions of PHP files and .htaccess files.
• Remediation priority is medium as the vulnerability requires high privileges to exploit.

Technical summary

The vulnerability exists in the Translate Module of Bitrix24 through version 25.100.300. An actor with SOURCE/WRITE permissions can upload and execute code by sending a PHP file and a .htaccess file. The Supplier disputes this as it is intended behavior for high-privileged users who can upload new translated pages to the website. Defenders should prioritize verifying the presence of this vulnerability in their Bitrix24 installations, especially if high-privileged users have SOURCE/WRITE permissions for the Translate Module. They should also monitor for any suspicious uploads or executions of PHP files and .htaccess files. The evidence for this vulnerability comes from the CVE Program record and the NVD detail

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Bitrix24 installations, especially if high-privileged users have SOURCE/WRITE permissions for the Translate Module. They should also monitor for any suspicious uploads or executions of PHP files and .htaccess files.

Recommended defensive actions

• Verify the presence of this vulnerability in Bitrix24 installations, especially if high-privileged users have SOURCE/WRITE permissions for the Translate Module.
• Monitor for any suspicious uploads or executions of PHP files and .htaccess files.
• Restrict permissions for the Translate Module to only necessary users.
• Implement additional security measures to detect and prevent code execution.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NVD vulnerability detail page. The CVE Program record provides the official CVE metadata, while the NVD vulnerability detail page provides a source-specific vulnerability assessment. Additional information is available from various source references, including documentation on the Translate Module and security advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.