Metasploit Framework: Path traversal in iOS image gather module
Summary
The post module post/apple_ios/gather/ios_image_gather in Metasploit Framework does not sanitize file names taken from an iOS device directory listing before writing them to the local system. A hostile or tampered device can supply names with path traversal sequences to write files outside the intended loot directory, such as a msfconsole.rc file that runs automatically at console startup. If an operator runs this module against such a device, an attacker can achieve code execution as the operator on the workstation.
Affected
- Rapid7 Metasploit Framework before 6.5.5 (CNA record: affected 0 to < 6.5.5)
Fixed in
- Metasploit Framework 6.5.5 and later
Workaround
Unknown. No workaround is documented by the vendor.
- Do not run this module against untrusted devices or sessions.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No evidence of in-the-wild exploitation was found.
- Exploitation requires the operator to run the module against an attacker-controlled device.
Our recommendation
- Upgrade Metasploit Framework to 6.5.5 or later on all systems, including consultant laptops and jump hosts.
- Until the upgrade, do not run post/apple_ios/gather/ios_image_gather against untrusted devices.
- Review ~/.msf4/ (msfconsole.rc and plugin files) for unexpected changes after using this module.
- Priority: high for security testing teams, low for general IT without Metasploit.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
h00die/CVE-2026-87690-POC-Metasploit-Dir-Traverse-to-RCE
Research sources
- Metasploit Framework 6.5.5 release github.com
- Metasploit Framework repository github.com
- Pull request #21880 (ios_image_gather store_loot change) github.com
- Rapid7 blog: Metasploit wrap-up www.rapid7.com
- Vulners CVE record vulners.com
- CVEMon CVE-2026-87690 cvemon.intruder.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:32.
Original description (NVD)
The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module achieves an arbitrary file write as the operator; because the written msfconsole.rc can load a second written file (a Ruby plugin whose top-level code runs on require), this converts into persistent code execution and an interactive shell as the operator (frequently root) on the pentester's workstation at the next console launch. The same traversal was previously fixed upstream in the recursive downloader (stdapi/fs/dir.rb scrubs separators); this module omitted the equivalent scrub. The fix applies the same separator scrub (or File.basename) to listing entries before building the local path.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.