The vulnerability is a remote code execution flaw (CWE-434) in Bitrix24’s Translate Module that permits a user with SOURCE/WRITE permissions to upload PHP code and an accompanying .htaccess file, allowing the execution of arbitrary code on the host. The flaw is a consequence of the module’s intended functionality, which the vendor claims allows high‑privileged users to add translated pages, but it effectively bypasses normal access controls. An attacker who can obtain or compel such permissions can cause a full compromise of the affected web server, leading to loss of confidentiality, integrity, and availability.

Bitrix24 versions up to and including 25.100.300 are affected; any installation using the Translate Module with SOURCE/WRITE permissions may be vulnerable. No other vendors or products are listed, so the impact is specific to Bitrix24 installations within the stated version range.

The exploit requires that the attacker is able to employ the Translate Module’s upload feature. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.3 indicates a medium severity given the remote code execution potential. The attack vector is inferred to be web‑based, with the attacker leveraging the module’s upload capability; this likely requires internal or privileged access to the system. The vendor’s disputed stance does not mitigate the technical risk whenever an attacker can create such permissions.