CVE-2025-67887

CRITICAL

1C-Bitrix through 25.100.500 - Remote Code Execution

Title source: manual

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-67887. PoCs published by cyberok-org, reewardius.

AI-analyzed exploit summary This repository provides a technical analysis and a hotfix for CVE-2025-67887, a vulnerability in the 1C-Bitrix Translate module that allows RCE via malicious .htaccess files in uploaded archives. The code includes a sanitization function to remove .htaccess files post-extraction.

Description

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.

Exploits (2)

nomisec WRITEUP

by cyberok-org · poc

https://github.com/cyberok-org/CVE-2025-67887

View Code ZIP pw:eip

This repository provides a technical analysis and a hotfix for CVE-2025-67887, a vulnerability in the 1C-Bitrix Translate module that allows RCE via malicious .htaccess files in uploaded archives. The code includes a sanitization function to remove .htaccess files post-extraction.

Classification

Writeup 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: 1C-Bitrix Translate Module

Auth required

Prerequisites: Administrator privileges (SOURCE and WRITE permissions in Translate Module) · Apache server with .htaccess support

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed May 22, 2026 Full analysis →

nomisec WORKING POC

by reewardius · poc

https://github.com/reewardius/CVE-2025-67887

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2025-67887, targeting a remote code execution vulnerability in 1C-Bitrix's Translate Module. The exploit authenticates, uploads a malicious archive, extracts it, and executes arbitrary commands via a shell.