EUVD-2026-83738
GHSA-hg88-qg2r-c8mx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid public survey hash
-
DeliveryCraft HTTP request abusing survey passthrough routing
-
ExploitReach unintended import controller route
-
ExecutionSupply crafted file-path/stream import parameter
-
ImpactExecute arbitrary code on REDCap server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a REDCap instance running version 13.3.0 or higher with a public survey feature in use, and (2) the attacker possessing a valid public survey hash - the token embedded in public survey URLs distributed to respondents. From that public-survey context the attacker manipulates HTTP requests to reach an unintended controller route (survey passthrough routing flaw) and must supply a crafted file-path/stream parameter to the Data Import processing logic. No authentication is required (PR:N) and no user interaction is needed, but the mandatory knowledge of a valid public survey hash limits mass/blind scanning and makes exploitation contingent on the target actively running public surveys. |
| Impact | This is a genuine high-priority finding: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes unauthenticated network RCE, and the CWE-94 code-injection classification is consistent with the described arbitrary code execution on the REDCap server. The single meaningful mitigating factor is the stated precondition - exploitation 'requires knowledge of a valid public survey hash' - which the CVSS vector does not capture (it is scored PR:N/AC:L as if no barrier exists); in practice public-survey hashes are distributed openly to respondents, so this is a realistic but non-zero barrier that makes exploitation opportunistic against institutions running active public surveys rather than blanket-scannable. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so per the precision rules the status is 'no public exploit identified at time of analysis' - meaning the 9.8 reflects potential impact, not confirmed active exploitation. The disclosing party (Securifera) is a credible offensive-security firm, but the only reference is a generic advisories landing page, so the technical write-up could not be corroborated. Net: treat as urgent to patch given unauthenticated RCE potential, while recognizing exploitation currently appears theoretical/targeted rather than widespread. |
| Exploit ScenarioDerived | An unauthenticated attacker who has obtained a valid public survey hash (e.g., from a shared survey link) crafts HTTP requests that abuse the survey passthrough routing to reach an unintended controller route, then invokes Data Import handling with a crafted file-path/stream parameter to trigger code execution on the REDCap server. No public proof-of-concept was provided; the attack is remote and low-complexity per CVSS but gated on possessing a survey hash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Unauthenticated remote code execution in REDCap 13.3.0 and later allows an attacker who knows a valid public survey hash to reach an unintended controller route through the survey passthrough routing logic and then supply a crafted file-path/stream parameter to the Data Import processing logic, resulting in arbitrary code execution on the REDCap server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms remote, unauthenticated exploitation with no user interaction required, but the mandatory knowledge of a valid public survey hash is a meaningful prerequisite that rules out blind mass scanning and confines practical exposure to instances actively publishing public surveys. Exploitation status: no public exploit identified at time of analysis; the flaw was reported by Securifera.
RemediationAI
No vendor-released patch version is identified in the available data, and patch status is not independently confirmed, so REDCap administrators should first consult the Securifera advisory index (https://www.securifera.com/advisories/) and the Vanderbilt REDCap project for the CVE-specific fixed release, then upgrade to that release as soon as it is published. Until a fix is confirmed and applied, the highest-value compensating control is to eliminate the required prerequisite: disable or un-publish public surveys (set surveys to non-public / disable public survey links) on internet-facing REDCap instances, which removes the valid public survey hash an attacker needs - the trade-off is broken respondent access to live data collection instruments. If public surveys must stay available, rotate all public survey hashes and regenerate links so previously distributed hashes are invalidated (this disrupts already-distributed links and in-progress responses), restrict survey hash validity windows where the platform permits, and place the instance behind a reverse proxy or WAF with rules that reject path-traversal and stream/path tokens in import-related parameters. Additional containment: restrict REDCap network exposure to trusted networks or a VPN with allow-listed respondents, block outbound egress from the REDCap host to limit post-exploitation callback and lateral movement (which can interfere with legitimate integrations), run the web/PHP service under a least-privileged OS account with no write access outside required data directories, and monitor/alert on anomalous requests to survey endpoints that carry file-path or stream parameters and on unexpected child processes spawned by the web server.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-94 (Improper Control of Generation of Code / code injection) defect in REDCap, the Vanderbilt University web-based electronic data capture platform identified by the CPE cpe:2.3:a:vanderbilt_university:redcap. Two distinct weaknesses are chained: a routing flaw in the public survey passthrough logic, where HTTP request manipulation from the context of a public survey endpoint can be redirected to a controller route that was never intended to be reachable without authentication, and an unsafe handling of a file-path/stream parameter in the Data Import processing logic that allows attacker-controlled input to influence code/stream generation or file resolution. Combined, the routing bypass removes the authentication gate and the import-handling flaw converts the reachable functionality into server-side code execution. Because the CVSS vector carries PR:N and UI:N with AV:N, no credentials and no victim interaction are needed; the only gate is possession of a valid public survey hash, which is embedded in the public survey URLs distributed to respondents and is therefore obtainable by anyone who has been given (or can observe) such a link.
Know when Redcap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote code execution (PR:N, full C/I/A:H); AC kept L since public survey hashes are openly distributed and thus obtainable, though the requirement mildly limits real-world reach.
Primary rating from Vendor (Securifera).
CVSS VectorVendor: Securifera
DescriptionCVE.org
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.
Articles & Coverage 1
Executive ViewAI
REDCap versions 13.3.0 and later are exposed to a critical unauthenticated remote code execution vulnerability that requires knowledge of a valid public survey hash. No public exploit identified at time of analysis; however, the flaw can lead to arbitrary code execution, potentially compromising sensitive research or patient data, and no vendor-released patch identified at time of analysis. Leadership should prioritize immediate mitigation because exploitation could result in data breaches, regulatory penalties, and reputational damage, especially for organizations that publish public surveys.
Disable public surveys if not operationally required; restrict network access to REDCap servers; deploy WAF rules to block crafted file-path/stream parameters; enable enhanced logging and monitoring for survey passthrough and Data Import endpoints; enforce least privilege for REDCap service accounts. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Reques
REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery
REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=
Multiple unspecified vulnerabilities in REDCap before 5.1.1 allow remote attackers to have an unknown impact via vectors
REDCap 14.7.0 allows HTML injection via the project title of a New Project action. Rated medium severity (CVSS 6.1), thi
A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. Rated mediu
Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3 and 5.1.x before 5.1.2 h
A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.
A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users t
A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users
A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated us
A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated user
Exploit-DB