Unauthenticated Remote Code Execution in REDCap by VENDOR

CVE-2026-90817

What is CVE-2026-90817?

An unauthenticated Remote Code Execution vulnerability affects REDCap, enabling attackers to exploit the survey passthrough routing and Data Import processing. By manipulating HTTP requests, a malicious user can target an unintended controller route from a public survey context and provide a crafted file-path or stream parameter during import handling. Successful exploitation allows the attacker to remotely execute arbitrary code on the REDCap server. Although authentication is not required, knowledge of a valid public survey hash is essential for exploitation. This vulnerability is present in REDCap versions 13.3.0 and above.

References