Technical impact
An actor possessing SOURCE/WRITE permissions within the Translate Module can upload a PHP file together with a .htaccess file that causes the web server to execute the code. The flaw is a code‑execution weakness (CWE‑94) that permits arbitrary PHP to run, potentially compromising confidentiality, integrity, and availability of the application and underlying server.
Affected Systems
All 1C‑Bitrix installations up to and including version 25.100.500 that have the Translate Module enabled and grant any user the SOURCE/WRITE permission are affected. No published information indicates this issue exists in later releases.
Risk and Exploitability
Based on the description, it is inferred that the attack vector is the web interface of the Translate Module and that an attacker must have an account with SOURCE/WRITE rights to exploit the flaw. The CVSS score of 9.8 classifies this as a critical remote code execution vulnerability. The EPSS score of 2 % suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only web‑access to the module and the appropriate permissions; no additional system privileges are mentioned.
