CVE-2025-67886: Bitrix24 RCE Vulnerability

CVE-2025-67886 Overview

CVE-2025-67886 affects Bitrix24 through version 25.100.300 and enables Remote Code Execution (RCE) through the Translate Module. An actor with SOURCE/WRITE permissions for the Translate Module can upload a PHP file together with a .htaccess file and trigger execution of arbitrary code on the web server. The vulnerability is categorized under CWE-434: Unrestricted Upload of File with Dangerous Type.

The vendor disputes this issue, stating the upload functionality is intended behavior for high-privileged users who legitimately upload translated pages to the website.

Critical Impact

Authenticated users with Translate Module write permissions can achieve arbitrary PHP code execution on the underlying Bitrix24 self-hosted server.

Affected Products

• Bitrix24 self-hosted through 25.100.300
• Bitrix24 Translate Module (SOURCE/WRITE permission scope)
• Apache-based deployments honoring uploaded .htaccess directives

Discovery Timeline

• 2026-05-08 - CVE-2025-67886 published to NVD
• 2026-05-08 - Last updated in NVD database

Technical Details for CVE-2025-67886

Vulnerability Analysis

The Translate Module in Bitrix24 permits privileged users to upload translation source files to the web-accessible directory tree. The module does not restrict the file types or filenames an authorized actor may write. An attacker holding SOURCE/WRITE rights can stage a malicious PHP payload alongside a crafted .htaccess file that re-enables PHP handling for the target directory or file extension. Once uploaded, requesting the PHP file via the web server triggers code execution in the context of the web service account.

The issue is tracked as CWE-434 (Unrestricted Upload of File with Dangerous Type). Public proof-of-concept material is referenced on the Karma In Security advisory and on the Full Disclosure mailing list.

Root Cause

The Translate Module trusts high-privileged users to upload arbitrary translation artifacts and does not enforce a server-side allowlist of safe file extensions or block per-directory Apache configuration overrides. Because .htaccess files placed in the upload path are honored by Apache, an attacker can change runtime behavior to execute PHP files that would otherwise be served as static content. The vendor classifies this design as intended for users with translation upload privileges.

Attack Vector

Exploitation requires an authenticated account with SOURCE/WRITE permissions to the Translate Module. The attacker submits a PHP payload through the Translate Module write API and a companion .htaccess that maps the chosen path or extension to the PHP handler. The attacker then issues an HTTP request to the uploaded file, causing the server to execute the embedded PHP code. No user interaction is required beyond the attacker's own authenticated session.

No synthetic exploit code is reproduced here. See the Karma In Security proof-of-concept and Bitrix Translate API documentation for technical specifics.

Detection Methods for CVE-2025-67886

Indicators of Compromise

• Unexpected .htaccess files appearing inside Bitrix24 translation directories such as /bitrix/modules/ language paths.
• New .php files written through the Translate Module that do not match legitimate language template names.
• Outbound network connections or shell processes originating from the PHP-FPM or Apache worker after a Translate Module write event.

Detection Strategies

• Audit Bitrix24 application logs for Translate Module write actions correlated with file creation events on disk.
• Monitor the web root for newly created .htaccess files using file integrity monitoring, and alert on any SetHandler or AddType directives referencing PHP.
• Review web server access logs for first-seen requests to .php files located inside translation directories.

Monitoring Recommendations

• Enable verbose audit logging for accounts granted SOURCE/WRITE rights on the Translate Module and review usage at least weekly.
• Forward web server, PHP-FPM, and Bitrix24 audit logs to a centralized analytics platform for correlation across upload, configuration, and execution events.
• Alert on process lineage where httpd, apache2, or php-fpm spawns shell interpreters such as /bin/sh, bash, or python.

How to Mitigate CVE-2025-67886

Immediate Actions Required

• Restrict the Translate Module SOURCE/WRITE permission to a minimal set of trusted administrators and remove it from general staff or integration accounts.
• Reset credentials for any account that previously held Translate Module write permissions if compromise is suspected.
• Inspect Bitrix24 translation directories for unauthorized .php or .htaccess files and remove any that are not part of an approved deployment.

Patch Information

The vendor disputes that this is a vulnerability and treats the upload behavior as intended for high-privileged users. No dedicated security patch has been published by Bitrix at the time of NVD publication. Organizations should review the Bitrix24 self-hosted documentation and the Bitrix Learning Course on the Translate Module to understand the privilege model, then apply compensating controls.

Workarounds

• Configure Apache to ignore per-directory overrides in the Bitrix24 web root by setting AllowOverride None for translation directories, preventing uploaded .htaccess files from changing PHP handling.
• Disable PHP execution under translation upload paths using a global server configuration that explicitly maps those directories to a static content handler.
• Place the Bitrix24 application behind a Web Application Firewall (WAF) rule that blocks uploads of .htaccess files and .php files through the Translate Module endpoints.
• Remove or disable the Translate Module on production servers where translation editing is not actively used.

# Example Apache hardening to neutralize uploaded .htaccess files
# and block PHP execution inside Bitrix24 translation directories
<Directory "/var/www/bitrix/modules">
    AllowOverride None
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>