CVE-2026-87690 Rapid7 CVE debrief

Who should care

Pentesters and security professionals using the Metasploit Framework should assess their exposure and update to version 6.5.5 or later. They should review and restrict usage of the ios_image_gather module, monitor for suspicious activity on the pentester's workstation, and confirm whether affected product deployments exist in managed environments. Additionally, they should review the supplied official advisory or CVE record to validate affected scope, and

Why it matters

The vulnerability allows an attacker to write arbitrary files and execute code on the pentester's workstation, potentially leading to persistent code execution and an interactive shell.

• Arbitrary file write and code execution on the pentester's workstation
• Persistent code execution and interactive shell as the operator

Technical summary

The ios_image_gather module in the Metasploit Framework is vulnerable to a path traversal attack. An attacker can exploit this vulnerability to write arbitrary files and execute code on the pentester's workstation. The module interpolates file names taken from a Meterpreter directory listing directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. This allows an attacker to escape the intended ~/.msf4/loot/<random> directory and overwrite sensitive files, such as ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup.

Defensive priority

High

Recommended defensive actions

• Update Metasploit Framework to version 6.5.5 or later
• Review and restrict usage of the ios_image_gather module
• Monitor for suspicious activity on the pentester's workstation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability exists in the ios_image_gather module of the Metasploit Framework. The module fails to properly sanitize file names taken from a Meterpreter directory listing, allowing an attacker to write arbitrary files and execute code on the pentester's workstation. The ios_image_gather module interpolates file names directly into the local destination path, passing it to client.fs.file.download_file() without validation. This can lead to arbitrary file writes and code execution, potentially resulting in persistent code

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.