/Vulnerability Library

REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru

CVE-2026-90817
Verified

Description

REDCap versions 13.3.0 through 16.0.48 LTS, 17.3.9 LTS, and 17.4.3 Standard contain an unauthenticated remote code execution vulnerability. The application is vulnerable to an authentication bypass via a double-URL-decoded __passthru parameter (%2569ndex.php -> index.php) on public survey endpoints, which routes requests to internal authenticated controllers. An unauthenticated attacker can abuse this routing flaw combined with PHP filter chains to inject and execute arbitrary code through the Laravel Blade template cache.

Severity

Critical

CVSS Score

9.8

Exploit Probability

4%

Affected Product

redcap

Published Date

October 23, 2026

Template Author

sudo-a-man

CVE-2026-90817.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-90817
CWE ID:
cwe-73, cwe-94

References

https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/https://github.com/securifera/CVE-2026-90817https://github.com/Farih123/CVE-2026-90817https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txthttps://www.cve.org/CVERecord?id=CVE-2026-90817https://nvd.nist.gov/vuln/detail/CVE-2026-90817

Remediation Steps

Upgrade REDCap to versions 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard or later.