What is the CVSS score of CVE-2025-67887?

CVE-2025-67887 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of 1C-Bitrix are affected by CVE-2025-67887?

Organizations running 1C-Bitrix Site Manager (versions through 25.100.500) face a critical code injection risk in the Translate Module where authenticated users with file-upload privileges could…

How to fix or mitigate CVE-2025-67887?

Within 24 hours, enumerate all users with SOURCE/WRITE permissions on the Bitrix Translate Module and review access logs for suspicious file uploads or unexpected PHP execution in the past 90 days. Within 7 days, if Bitrix is internet-facing, deploy Web Application Firewall rules to restrict Translate Module upload functionality to trusted IP addresses, and immediately revoke SOURCE/WRITE permissions for all users who do not require them for core translation operations. Within 30 days, escalate to Bitrix support requesting a formal security advisory and remediation timeline; if the vendor continues to classify this as non-vulnerability, begin parallel evaluation of alternative CMS platforms and implement supplemental controls such as disabling PHP execution in upload directories via .htaccess or nginx configuration.

1C-Bitrix CVE-2025-67887

EUVD-2025-209735 CRITICAL

Code Injection (CWE-94)

2026-05-08 mitre

GHSA-2636-hvcv-37w8

PHP RCE Code Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Reachable over the network with low complexity, but requires high-privilege Translate SOURCE/WRITE rights (PR:H); resulting code execution gives full C/I/A impact on the unchanged scope host.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:56 vuln.today

CVSS changed

May 11, 2026 - 20:37 NVD

9.8 (CRITICAL)

CVE Published

May 08, 2026 - 00:00 nvd

CRITICAL 9.8

CVE Published

May 08, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.

AnalysisAI

Code injection in 1C-Bitrix (Bitrix Site Manager) through 25.100.500 lets an actor holding SOURCE/WRITE permissions on the Translate Module upload a PHP file together with a .htaccess file and have it executed by the web server, yielding arbitrary code execution on the host. Publicly available exploit code exists (karmainsecurity PoC), but there is no public exploit identified as actively used in attacks, and EPSS is very low at 0.02%. Notably, the vendor disputes this as a vulnerability, calling it intended behavior for high-privileged users who legitimately upload translated pages.

Technical ContextAI

1C-Bitrix is a PHP-based commercial CMS/enterprise portal platform widely used in the Russian and CIS market. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the Translate Module's file-management feature permits users with SOURCE/WRITE rights to write arbitrary files into the web-served directory tree. By combining an uploaded .php payload with a crafted .htaccess file (which can force PHP handling or override server directives), the attacker turns a legitimate translation-file upload capability into server-side code execution. The advertised CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and provides no reliable product/version enumeration; identification rests on the CVE description and vendor documentation for the Translate module.

RemediationAI

No vendor-released patch identified at time of analysis; the supplier disputes the issue and treats the behavior as intended for high-privileged users, so a fix release should not be assumed. The most effective compensating control is to treat SOURCE/WRITE permission on the Translate Module as equivalent to full server code execution and grant it only to fully trusted administrators, removing it from any lower-trust or delegated roles (trade-off: legitimate translators lose self-service upload and must route changes through an admin). Additionally, configure the web server to deny execution of PHP within Translate/upload directories and to ignore per-directory .htaccess overrides there (Apache: AllowOverride None on those paths), which blocks the .htaccess-driven handler abuse but may break sites that legitimately rely on directory-level overrides. Monitor uploads of .php and .htaccess files under translation paths. Track advisories via https://www.1c-bitrix.ru/support/index.php; PoC details are at https://karmainsecurity.com/pocs/CVE-2025-67887.php and https://seclists.org/fulldisclosure/2025/Dec/22.