This vulnerability concerns 1C-Bitrix versions up to 25.100.500, where users granted SOURCE/WRITE permissions on the Translate Module can upload PHP files and .htaccess files, enabling remote code execution. The supplier considers this functionality intentional for users with elevated privileges responsible for uploading translated content. There is no CVSS score or official remediation level assigned, and no patch links are available. The issue is published but disputed by the vendor as not a security flaw but a feature for authorized users.

If an attacker gains SOURCE/WRITE permissions on the Translate Module, they could execute arbitrary PHP code on the server, potentially leading to full system compromise. However, this capability is limited to users who already have high-level permissions, which reduces the risk to unauthorized actors. No evidence of exploitation in the wild has been reported.

No official patch or remediation is currently available. Since the supplier states this behavior is intended for users with high privileges, organizations should ensure that SOURCE/WRITE permissions on the Translate Module are strictly controlled and granted only to trusted administrators. Monitor and audit user permissions to prevent unauthorized privilege escalation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.