CVE-2026-90817: REDCap Survey RCE Vulnerability

CVE-2026-90817 Overview

CVE-2026-90817 is an unauthenticated Remote Code Execution (RCE) vulnerability in REDCap, the research electronic data capture platform. The flaw exists in the survey passthrough routing logic and the Data Import processing component. An attacker who knows a valid public survey hash can manipulate HTTP requests to reach an unintended controller route and supply a crafted file-path or stream parameter during import handling. Successful exploitation allows arbitrary code execution on the REDCap server without authentication. The vulnerability affects REDCap 13.3.0 and higher and is classified under [CWE-73] External Control of File Name or Path.

Critical Impact
Unauthenticated attackers with knowledge of a public survey hash can execute arbitrary code on the REDCap server, exposing research and clinical data.

Affected Products

REDCap 13.3.0 and higher
REDCap survey passthrough routing component
REDCap Data Import processing logic

Discovery Timeline

2026-09-20 - CVE-2026-90817 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-90817

Vulnerability Analysis

The vulnerability chains two weaknesses in REDCap. The first is a routing flaw in the public survey passthrough handler, which allows an unauthenticated request originating in a public survey context to invoke controller routes that should be restricted to authenticated sessions. The second is unsafe handling of user-controlled file-path and stream parameters inside the Data Import processing logic.

By combining both flaws, an attacker who possesses a valid public survey hash can reach the import controller without credentials and pass a crafted path or stream identifier. The import handler then processes attacker-controlled content in a code execution context on the server. The underlying weakness is external control of file name or path [CWE-73].

Root Cause

The root cause is insufficient authorization enforcement on controller routes reachable through the survey passthrough layer, combined with missing validation of file-path and stream parameters accepted by the Data Import handler. Trust is derived from the presence of a public survey hash rather than from a scoped authorization check on the target action.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. The attacker must know a valid public survey hash, which is often shared broadly for participant recruitment. Using this hash, the attacker issues an HTTP request that passes through the survey routing layer and lands on the Data Import controller with a crafted file-path or stream parameter, triggering code execution.

Refer to the Securifera Security Advisory for additional technical details.

Detection Methods for CVE-2026-90817

Indicators of Compromise

HTTP requests targeting survey passthrough endpoints that include unexpected controller or action parameters not typically invoked from a public survey.
Data Import controller invocations originating from unauthenticated sessions carrying a public survey hash.
File-path or stream parameters containing absolute paths, protocol wrappers (php://, file://, data://), or path traversal sequences.
New or modified PHP files, cron entries, or web shells created under the REDCap webroot after suspicious survey requests.

Detection Strategies

Inspect web server access logs for anomalous query strings on survey URLs, particularly parameters referencing import, data upload, or file handling actions.
Correlate public survey requests with subsequent server-side process creation events, such as php spawning shells or network utilities.
Alert on outbound connections from the REDCap application server to unexpected destinations following survey traffic bursts.

Monitoring Recommendations

Enable verbose application logging for the survey routing layer and Data Import controller and forward events to a centralized SIEM.
Monitor file integrity on the REDCap web directory and configuration paths to catch unauthorized writes.
Track process lineage on the web server host to identify shell or interpreter execution spawned by the web process.

How to Mitigate CVE-2026-90817

Immediate Actions Required

Identify all REDCap instances running version 13.3.0 or later and prioritize patching internet-facing deployments.
Rotate or invalidate existing public survey hashes where feasible, since exploitation requires knowledge of a valid hash.
Restrict network access to the REDCap application to trusted networks or via a web application firewall (WAF) until patched.
Review web server and application logs for evidence of prior exploitation attempts against survey endpoints.

Patch Information

Apply the security update issued by the REDCap vendor (Vanderbilt University) for versions 13.3.0 and higher. Consult the Securifera Security Advisory and the official REDCap consortium release notes for the fixed version. No public exploit or CISA KEV listing has been recorded at the time of publication.

Workarounds

Place REDCap behind a WAF and block requests to survey endpoints that carry controller or file-path parameters not expected by the public survey flow.
Disable or restrict the Data Import functionality if it is not required, and constrain its handlers to authenticated administrative sessions.
Enforce network segmentation so the REDCap server cannot initiate arbitrary outbound connections or reach sensitive internal services.

bash

# Example WAF rule concept: block suspicious parameters on survey passthrough URIs
# (adapt to your WAF syntax, e.g., ModSecurity, AWS WAF, Azure WAF)
SecRule REQUEST_URI "@rx /surveys/" \
  "chain,phase:2,deny,status:403,id:1090817,\
   msg:'CVE-2026-90817 REDCap survey passthrough abuse'"
  SecRule ARGS_NAMES|ARGS "@rx (?:php://|file://|data://|\.\./|/etc/|/var/www/)" \
    "t:lowercase,t:urlDecodeUni"