The vulnerability of the 1C-Bitrix web project management system allows a hacker to implant and exploit any arbitrary local file.

The vulnerability of the bitrix.mpbuilder module of the 1C-Bitrix web project management system exists due to insufficient restrictions on the path name to the directory. Exploiting this vulnerability allows a malicious actor to remotely introduce and open any local file by adding the symbol “..”...