CVE-2026-90817
CriticalCVSS 9.8Summary
An unauthenticated Remote Code Execution vulnerability was found in REDCap 13.3.0 and higher in the survey passthrough routing and Data Import processing logic. An attacker can manipulate HTTP requests to access an unintended controller route from a public survey context and supply a crafted file-path/stream parameter during import handling. Exploitation requires knowledge of a valid public survey hash.
Risk Assessment
The vulnerability allows an unauthenticated attacker to remotely execute arbitrary code on the REDCap server, potentially leading to full system compromise and exposure of research data. Only knowledge of a public survey hash is required, which is realistic for public surveys.
Recommendation
Immediately update REDCap to a patched version and restrict access to public surveys, while monitoring for unusual requests to controller routes and data import handling.
Other vulnerabilities in REDCap
See all- CVE-2024-55374Medium
A vulnerability in REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy in login attempt responses.
- CVE-2023-37798Medium
A stored XSS vulnerability was discovered in REDCap 13.1.35 in the new project creation function. Attackers can inject malicious JavaScript or HTML into the project title parameter, leading to script execution in other users' browsers.
- CVE-2023-37361Low
REDCap versions 12.0.26 LTS and 12.3.2 Standard allow SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.
Original NVD description (English source)
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.