This vulnerability involves Bitrix24 versions up to 25.100.300 where an actor with SOURCE/WRITE permissions on the Translate Module can upload and execute arbitrary PHP code by submitting a PHP file and a .htaccess file. The supplier considers this functionality intentional for users with elevated privileges responsible for uploading translated content, thus disputing its classification as a vulnerability. No CVSS score or patch information is available, and no known exploits have been reported in the wild.

If an unauthorized or malicious actor gains SOURCE/WRITE permissions on the Translate Module, they could execute arbitrary PHP code on the server, potentially leading to full system compromise. However, since this capability is limited to users with high privileges, the impact is constrained to the risk of privilege misuse rather than an unprivileged remote code execution vulnerability.

No official patch or remediation guidance is available. Since the supplier states this behavior is intended for high-privileged users, mitigation should focus on strict access control and ensuring that only trusted users have SOURCE/WRITE permissions on the Translate Module. Regularly review and audit user permissions to prevent privilege abuse.