What is the CVSS score of CVE-2025-67886?

CVE-2025-67886 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Bitrix24 CVE-2025-67886

EUVD-2025-209734 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-08 mitre

GHSA-73qc-9hmq-7x6f

PHP RCE File Upload N A

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 18:23 vuln.today

CVSS changed

May 08, 2026 - 18:22 NVD

6.3 (MEDIUM)

CVE Published

May 08, 2026 - 00:00 nvd

MEDIUM 6.3

CVE Published

May 08, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.

AnalysisAI

Remote code execution in Bitrix24 through version 25.100.300 allows authenticated users with SOURCE/WRITE permissions on the Translate Module to execute arbitrary PHP code by uploading malicious PHP and .htaccess files. The vulnerability exploits unrestricted file upload capability in a high-privilege context; while the vendor disputes this as intended behavior for administrative users, the low EPSS score (0.02%) and lack of evidence of active exploitation suggest this poses minimal real-world risk despite the moderate CVSS rating.

Technical ContextAI

Bitrix24's Translate Module implements file upload functionality for managing translated content. The vulnerability stems from improper file upload validation (CWE-434: Unrestricted Upload of File with Dangerous Type), allowing authenticated users to bypass restrictions by uploading both a PHP file and a .htaccess configuration file. The .htaccess file modifies Apache's handling of subsequent requests, enabling execution of uploaded PHP as code rather than serving it as static content. This is a classic Apache web server misconfiguration vector where directory-level directives can override global restrictions. The affected versions include Bitrix24 self-hosted deployments running through version 25.100.300.

RemediationAI

Upgrade Bitrix24 to a patched version released after 25.100.300 (exact version number not specified in available data; consult vendor release notes). Until a patch is available, restrict SOURCE/WRITE permissions on the Translate Module to only trusted administrators and disable file upload functionality in the Translate Module if not actively required. Configure Apache to reject .htaccess files in upload directories via server-level directives (e.g., <Directory /path/to/uploads> AllowOverride None </Directory>), preventing attackers from modifying handler rules. Alternatively, store uploaded translation files outside the web root and serve them through a PHP proxy script that performs content-type validation. Monitor upload directories for suspicious .htaccess and PHP file combinations. These controls trade administrative convenience for security but effectively neutralize this attack vector without disabling the Translate Module entirely.