CVE-2026-90817: REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru
Vanderbilt University · REDCap
Vendor fix available · Affected: Vanderbilt University REDCap · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 90% of scored CVEs
DescriptionCVE.org
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Vanderbilt University · REDCap13.3.0
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru · nuclei template in projectdiscovery/nuclei-templates
- Published
- September 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-90817 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.