CVE-2025-67886

MEDIUM

Bitrix24 through 25.100.300 - Remote Code Execution

Title source: manual

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-67886. PoCs published by reewardius.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-67886, targeting a remote code execution vulnerability in Bitrix24's Translate Module. The exploit authenticates, uploads a malicious archive, extracts it, and executes a reverse shell.

Description

Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.

Exploits (1)

nomisec WORKING POC

by reewardius · poc

https://github.com/reewardius/CVE-2025-67886

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2025-67886, targeting a remote code execution vulnerability in Bitrix24's Translate Module. The exploit authenticates, uploads a malicious archive, extracts it, and executes a reverse shell.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Bitrix24 <= 25.100.300

Auth required

Prerequisites: valid credentials · cURL extension

MITRE ATT&CK