REDCap - RCE (CVE-2026-90817)
Description
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.
psychologyCrowdSec Analysis
CVE-2026-90817 is a critical unauthenticated remote code execution vulnerability in REDCap 13.3.0 and higher, involving survey passthrough routing and Data Import processing. An attacker who knows a valid public survey hash could manipulate HTTP requests and provide a crafted file-path or stream parameter to execute arbitrary code on the REDCap server.
CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-90817 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Observed exploitation attempts target REDCap public survey endpoints under /surveys/ and include the double-URL-encoded __passthru=%2569ndex.php parameter to bypass authentication and route requests to internal controllers. The template’s probe also uses route=ParcelController%3Ashow.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-09-20 |
| Rule Released | 2026-10-24 |
Related Weaknesses
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
The product allows user input to control or influence paths or file names that are used in filesystem operations.