full-disclosure - [FD] [KIS-2025-08] 1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability

Open Source and information security mailing list archives

Message-ID: <CAJeQoQe-4_79W62DYBVqyy_2ZCO1ArBtJ=YVDJDEY94WC6BwgA@mail.gmail.com>
Date: Mon, 15 Dec 2025 16:56:09 +0100
From: Egidio Romano <n0b0d13s@...il.com>
To: fulldisclosure@...lists.org
Cc: submissions@...ketstormsecurity.com, submit@...sec.com
Subject: [FD] [KIS-2025-08] 1C-Bitrix <= 25.100.500 (Translate Module)
 Remote Code Execution Vulnerability

------------------------------------------------------------------------------
1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability
------------------------------------------------------------------------------

[-] Software Link:

https://www.1c-bitrix.ru

[-] Affected Versions:

Version 25.100.500 and prior versions.

[-] Vulnerability Description:

The vulnerability is located within the "Translate Module", which
allows users to upload and extract archive files into a temporary
directory. However, the application fails to properly verify the
contents of these archives before extracting them. This can be
exploited by malicious users to upload and execute arbitrary PHP code
by including a PHP file along with a specially crafted .htaccess file
within the archive.

Successful exploitation of this vulnerability requires an account with
"SOURCE" and "WRITE" permissions for the "Translate Module".

[-] Proof of Concept:

https://karmainsecurity.com/pocs/CVE-2025-67887.php

[-] Solution:

No official solution is currently available.

[-] Disclosure Timeline:

[22/10/2025] - Vendor notified, no response
[03/11/2025] - Vendor contacted again, no response
[12/11/2025] - CVE identifier requested
[12/12/2025] - CVE identifier assigned
[15/12/2025] - Public disclosure

[-] CVE Reference:

The Common Vulnerabilities and Exposures program (cve.org) has
assigned the name CVE-2025-67887 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2025-08
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives