This vulnerability in 1C-Bitrix affects versions through 25.100.500 and involves the Translate Module. An actor with SOURCE/WRITE permissions can upload a PHP file and a .htaccess file, enabling remote code execution on the server. The supplier considers this functionality intended for privileged users, thus disputing the classification as a vulnerability. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network exploitable, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level is provided.

Successful exploitation allows remote code execution with the privileges of the web server, potentially leading to full system compromise. Confidentiality, integrity, and availability of the affected system are severely impacted. However, exploitation requires SOURCE/WRITE permissions on the Translate Module, which implies the attacker must already have high-level access or permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the supplier disputes this as a vulnerability due to intended behavior for privileged users, organizations should carefully review and restrict SOURCE/WRITE permissions on the Translate Module to trusted administrators only. Monitoring and controlling user permissions is critical to mitigate risk.