CVE-2026-87690
Received Received - Intake

Relative Path Traversal in Metasploit Framework Post Module

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Rapid7, Inc.

Description
The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module achieves an arbitrary file write as the operator; because the written msfconsole.rc can load a second written file (a Ruby plugin whose top-level code runs on require), this converts into persistent code execution and an interactive shell as the operator (frequently root) on the pentester's workstation at the next console launch. The same traversal was previously fixed upstream in the recursive downloader (stdapi/fs/dir.rb scrubs separators); this module omitted the equivalent scrub. The fix applies the same separator scrub (or File.basename) to listing entries before building the local path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-87690
EUVD
EUVD-2026-97177

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Rapid7 Metasploit Framework 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a relative path traversal issue in the Metasploit Framework's post module for iOS image gathering. It allows an attacker to write arbitrary files to the operator's workstation by exploiting how file names from a Meterpreter directory listing are interpolated into local destination paths without sanitization. This can lead to overwriting critical files like ~/.msf4/msfconsole.rc, which executes automatically at startup, enabling persistent code execution and an interactive shell as the operator.

Detection Guidance

Check for unauthorized modifications to ~/.msf4/msfconsole.rc or other critical Metasploit files. Review Metasploit logs for suspicious module usage, particularly post/apple_ios/gather/ios_image_gather. Use file integrity monitoring tools to detect unexpected changes in ~/.msf4/ directory.

Impact Analysis

If you use the affected Metasploit module, an attacker could trick you into running it on a compromised iOS device. This could overwrite sensitive files on your workstation, execute malicious code automatically when you next launch Metasploit, and potentially grant the attacker full control over your system, often as the root user.

Compliance Impact

This vulnerability could lead to unauthorized code execution and data breaches, violating compliance requirements such as GDPR's data protection principles or HIPAA's security rules. It may result in unauthorized access to sensitive data, requiring breach notifications and potential regulatory penalties.

Mitigation Strategies

Update Metasploit Framework to the latest version to apply the fix for CVE-2026-87690. Remove or restrict access to the vulnerable module post/apple_ios/gather/ios_image_gather. Monitor ~/.msf4/msfconsole.rc for unauthorized changes and restore from a known good backup if compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87690. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart