cyberok-org/cve-2025-67887
1C-Bitrix Security The Information Security and Incident Monitoring Center of 1C-Bitrix informs
Information appeared in Telegram channels about a vulnerability in the "Translate" module allegedly allowing unauthorized uploading of archives without a security check.
We promptly conducted checks and DO NOT confirm the presence of a vulnerability in the product. File uploads to the "Translations" module are only available to administrators. The required permissions mentioned in the message correspond to administrator rights. The administrator is authorized to modify and run any code on the project.
Thus, there is no vulnerability.
https://t.me/bitrixkiberbez/76
The fix implements a recursive directory sanitizer that detects and removes any variations of .htaccess files after archive extraction.
/**
* Removes any variation of .htaccess files from the extracted directory.
* Covers case sensitivity (.HTACCESS) and trailing dots/spaces.
* By CyberOK | https://www.cyberok.ru/
*/
private function sanitizeDirectory(Translate\IO\Directory $dir): void
{
foreach ($dir->getChildren() as $entry) {
if ($entry instanceof Main\IO\Directory) {
$this->sanitizeDirectory(new Translate\IO\Directory($entry->getPhysicalPath()));
} else {
if (preg_match('/^\.htaccess[.\s]*$/i', $entry->getName())) {
$entry->delete();
}
}
}
}
bitrix/modules/translate/lib/controller/asset/extract.php
🧯 RCE in 1C-Bitrix, but there is a nuance
On December 15, 2025, a public disclosure of vulnerabilities CVE-2025-67886/CVE-2025-67887 in 1C-Bitrix was released. The patch has not been released at the moment, PoC is available.
🔥 Vulnerability description The vulnerabilities are in the Translate Module 1C-Bitrix, which allows uploading and extracting archives to a temporary directory. However, the system does not check the contents of archives before extraction — this allows an attacker to include a PHP file and a specially crafted .htaccess in the archive, achieve its extraction and execution on the server.
📌 Important! Why this RCE is not for everyone
• For successful exploitation, the attacker needs to have “SOURCE” and “WRITE” permissions for the Translate Module. In fact, these permissions already imply the ability to modify PHP files.
• Infrastructures running on pure Nginx (without Apache / without .htaccess handler) are not susceptible to full RCE — PHP files are typically served as static files.
• On an nginx → Apache stack or pure Apache with AllowOverride enabled, the scenario is closer to a "real" RCE but with administrator rights.
🔥Colleagues from 1C-Bitrix confirm our conclusions in their official message: https://t.me/bitrixkiberbez/76
📊 Scale According to SKIPA data, there are about 2,000,000 instances of 1C-Bitrix in the RuNet. Potentially ~10% of hosts may be affected by this issue. PentOps clients were notified in a timely manner.
📐 Risk assessment ✖️ Official CVSS not yet assigned ✖️Formally CVSS is high, but in practice — low due to required privileges. ✖️ CyberOK recalculation (base CVSS v3.1): 7.2 (High) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H ✖️ Temporal metric (as of today): 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C ✖️ CyberOK RWD (Real World Danger) rating: 3/5 — real risk of exploitation
📦 Vulnerable versions • CVE-2025-67887: all versions of 1C-Bitrix <= 25.100.500 • CVE-2025-67886: all versions of Bitrix24 <= 25.100.300
🔧 Proof of Concept Publicly available PoC confirmed.
📌 What to look for in logs Sequential localization upload chain (key indicator):
⚠️ The apply endpoint is the most critical, as it returns the path to the temporary directory where the uploaded shell may be located.
🛡 Recommendations for protection and verification
Access rights: Urgently check who has been granted access to the module — remove SOURCE/WRITE from everyone except a narrow circle of admins (or better yet, temporarily close the module).
Network restriction: Close access to the translate controllers (at least to the extraction handlers) via WAF/ACL, leaving only admin IPs/VPN.
Web server: Apache: prohibit .htaccess in writable directories (AllowOverride None) and/or prohibit handlers/PHP execution where extraction can occur. Nginx: ensure PHP is executed only in expected locations (and definitely not from upload/tmp/cache/temporary directories). In emergency mode, you can additionally monitor and delete appearing .htaccess files in writable directories, but this is a crutch — it's better to cut at the configuration level.
Check the BXTEMP-XXXX-XX-XX folder for suspicious archives, non-standard subfolders, and .php files. For example: /www/upload/tmp/BXTEMP-2025-12-18/16/translate
💣 Conclusions Yes, this is RCE, but it all comes down to privileges and the web server configuration. For successful exploitation, you need permissions that already give access to the PHP command line tool; the tool allows executing PHP code without hoopla and file uploads. Check the permissions of the "Translate" module and prohibit execution in writable zones — this covers most of the real risk.
🖇 Sources Advisory KIS-2025-08 / CVE-2025-67887 NGINX Community Blog