Unauthenticated RCE in REDCap via survey routing and data import handler

Unauthenticated remote code execution in REDCap. The vulnerability spans two components: the survey passthrough routing module, which accepts crafted HTTP requests that reach controller routes outside the intended public-facing scope, and the data import handler, which processes file-path and stream parameters without adequate restriction. Combining both conditions from the public survey entry point allows arbitrary code execution on the server without any credentials.

Consult the Securifera advisory for affected versions and patch details.