← Back to search

CVE-2026-90817

9.8 CRITICAL

Published 2026-09-20 · Updated 2026-09-22

AI risk analysis

Summary
This vulnerability allows unauthenticated attackers to execute arbitrary code on the REDCap server by manipulating HTTP requests and exploiting survey passthrough routing and data import logic.
Exploitability
Exploitation requires knowledge of a valid public survey hash and is moderately difficult due to the need for precise HTTP request manipulation.
Blast radius
If exploited, this could result in full server compromise, allowing attackers to execute arbitrary code and potentially gain access to sensitive data.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to REDCap 13.3.1 or later.
rcewebunauthcode-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-73, CWE-94

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.