Rapid7 Metasploit Framework up to 6.5.4 ios_image_gather file.rb client.fs.file.download_file path traversal

Summaryinfo

A vulnerability has been found in Rapid7 Metasploit Framework up to 6.5.4 and classified as very critical. This affects the function client.fs.file.download_file of the file lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb of the component ios_image_gather. The manipulation leads to path traversal. This vulnerability is referenced as CVE-2026-87690. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Rapid7 Metasploit Framework up to 6.5.4. It has been rated as very critical. This issue affects the function client.fs.file.download_file of the file lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb of the component ios_image_gather. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module achieves an arbitrary file write as the operator; because the written msfconsole.rc can load a second written file (a Ruby plugin whose top-level code runs on require), this converts into persistent code execution and an interactive shell as the operator (frequently root) on the pentester's workstation at the next console launch. The same traversal was previously fixed upstream in the recursive downloader (stdapi/fs/dir.rb scrubs separators); this module omitted the equivalent scrub. The fix applies the same separator scrub (or File.basename) to listing entries before building the local path.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-87690 since 09/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/12/2026). MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 6.5.5 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Rapid7

Name

• Metasploit Framework

Version

• 6.5.0
• 6.5.1
• 6.5.2
• 6.5.3
• 6.5.4

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion