CVE-2026-90817

Name of the Vulnerable Software and Affected Versions REDCap versions 13.3.0 through 16.0.48 REDCap versions 17.0.0 through 17.3.9 REDCap versions 17.4.0 through 17.4.3

Description An unauthenticated remote code execution issue exists in the survey passthrough routing and Data Import processing logic. A malicious actor can manipulate HTTP requests to access an unintended controller route from a public survey context and provide a crafted file-path/stream parameter during import handling. This allows the execution of arbitrary code on the server. While authentication is not required, the attacker must possess a valid public survey hash. Real-world incidents have been observed where attackers used this flaw to deploy a Blade webshell and install XMRig, a cryptocurrency miner, which was disguised as a JPG file and renamed to syslog to evade detection.

Recommendations Update to version 16.0.49, 17.3.10, or 17.4.4. Inspect temporary and cache directories for unauthorized webshells or files named after system log files. Implement monitoring rules on survey endpoints to alert on requests that trigger code execution. Verify if public survey hashes are guessable or enumerable to reduce the risk of scanning.