CVE-2026-90817
Received Received - Intake

Unauthenticated Remote Code Execution in REDCap

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: Securifera, Inc.

Description
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-90817
EUVD
EUVD-2026-83738

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
securifera redcap From 13.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated Remote Code Execution (RCE) vulnerability in REDCap affecting versions 13.3.0 and higher. It exists in the survey passthrough routing and Data Import processing logic. An attacker can exploit it by manipulating HTTP requests to access unintended controller routes from a public survey context and providing a crafted file-path/stream parameter during import handling. Successful exploitation allows arbitrary code execution on the REDCap server without authentication, but requires knowledge of a valid public survey hash.

Detection Guidance

Detection requires monitoring for unusual HTTP requests targeting REDCap's DataImport functionality or survey passthrough routes. Check server logs for requests with crafted file-path or stream parameters, especially those referencing public survey hashes. No specific commands are provided in the available resources.

Impact Analysis

This vulnerability allows attackers to remotely execute arbitrary code on your REDCap server. Since it does not require authentication, attackers only need to know a valid public survey hash. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. The high CVSS score (9.8) indicates severe impact on confidentiality, integrity, and availability.

Compliance Impact

This RCE vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could lead to data breaches, unauthorized disclosures, or data integrity violations, resulting in regulatory penalties, legal liabilities, and reputational damage.

Mitigation Strategies

Immediately update REDCap to the latest patched version to address the unauthenticated Remote Code Execution vulnerability in the survey passthrough routing and Data Import processing logic. Ensure all public survey hashes are reviewed and restricted if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart