Bitrix24 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Bitrix24 CVE published 2026-05-08

CVE-2025-67886

CVE-2025-67886 is a Remote Code Execution vulnerability in Bitrix24 through version 25.100.300. An actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. The Supplier disputes this as it is intended behavior for high-privileged users who can upload new translated pages to the website.