Relative Path Traversal Vulnerability in Metasploit Framework by Rapid7

CVE-2026-87690

What is CVE-2026-87690?

The Metasploit Framework contains a vulnerability that allows attackers to exploit a relative path traversal issue in its iOS image gathering module. By taking advantage of unvalidated file names from a Meterpreter directory listing, an attacker can manipulate the local destination path, enabling arbitrary file writing. This could overwrite the essential msfconsole.rc file used by the Metasploit console, allowing the execution of malicious code and gaining an interactive shell with elevated privileges on the operator's workstation. The vulnerability arises because the necessary path sanitization procedure was omitted in this module, a flaw that was previously addressed in other parts of the framework.

References