Description

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-20T13:17:44.973Z",
  "pubdate": "2026-09-20T13:17:44.973Z",
  "executiveSummary": "REDCap versions 13.3.0 and higher contain a critical Remote Code Execution (RCE) vulnerability stemming from improper input validation within survey passthrough routing and Data Import processing logic.\nThe vulnerability allows an unauthenticated, remote attacker to execute arbitrary code on the underlying server by manipulating HTTP requests to access unauthorized controller routes.\nExploitation requires the attacker to possess a valid public survey hash to facilitate the initial request vector, though no formal authentication is required.\nSuccessful exploitation results in full system compromise, enabling the attacker to execute arbitrary commands with the privileges of the web server process.\nThe flaw highlights a failure in the application's request routing security and server-side file handling mechanisms during data ingestion processes.",
  "technicalDetails": "The vulnerability resides within the application's survey passthrough routing mechanism and the associated Data Import processing logic. The root cause is an insufficient validation of user-supplied input during the routing process, which allows an attacker to bypass intended access controls and invoke restricted controller methods from a public survey context.\nThe attack flow begins with the manipulation of HTTP requests directed at the survey interface. By leveraging a known valid public survey hash, an attacker can bypass standard authentication mechanisms. The attacker crafts requests that target specific controller routes not intended for public access. During the interaction with the Data Import processing logic, the attacker provides a maliciously crafted file-path or stream parameter.\nWhen the application processes this input, the vulnerable code fails to adequately sanitize the path or validate the source of the data stream. This deficiency facilitates a path traversal or stream injection scenario where the backend logic interacts with unintended resources or system files.\nIf the application passes this controlled input to a sink that executes file system operations or command execution functions—often related to processing or importing external data—the attacker can achieve Remote Code Execution. By pointing the application to a malicious file or stream, the server-side interpreter or underlying operating system executes the attacker's payload.\nThe vulnerability impacts REDCap version 13.3.0 and subsequent releases. It represents a significant failure in the application's 'secure by design' principles, specifically in the separation between public-facing survey endpoints and internal administrative/data processing controllers. Because the vulnerability does not require authentication, the attack surface is significantly increased for any REDCap instance hosting public surveys.\nPost-exploitation, the attacker operates within the context of the web server user, typically allowing for lateral movement, data exfiltration, or complete persistence on the host server environment. The impact is severe, as it bypasses standard application-level access controls and grants the attacker command-level access to the hosting server."
}