Is CVE-2026-87690 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87690 being exploited in the wild.

How severe is CVE-2026-87690?

High severity, with a CVSS score of 8.8, published 12 October 2026.

How is CVE-2026-87690 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87690?

Check whether you run Rapid7 Metasploit Framework. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87690: Metasploit Framework relative path traversal in iOS image gather

CVE-2026-87690 · Severity: high · CVSS 8.8 · Published 2026-10-12

The Metasploit Framework includes a post-exploitation module used to collect images from compromised iOS devices. This module fails to sanitize file names from the target device, allowing an attacker-controlled device to write files outside the intended directory on the pentester's workstation. By crafting malicious file names, an attacker can overwrite resource files that execute automatically when Metasploit starts, leading to arbitrary code execution on the operator's machine with their privileges.

Technologies: Rapid7 Metasploit Framework. Vendors: Rapid7.

Quick answers

Is CVE-2026-87690 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87690 being exploited in the wild.
How severe is CVE-2026-87690?: High severity, with a CVSS score of 8.8, published 12 October 2026.
Which products and versions are affected?: Rapid7 Metasploit Framework.
Is there a fix for CVE-2026-87690?: Yes: fixed in Rapid7 has merged the fix in PR #21880 (commit applies File.basename or separator scrubbing to path entries). Until then: Do not run the ios_image_gather module against untrusted or potentially compromised iOS devices; restrict execution of Metasploit post modules to trusted targets only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87690 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87690?: Check whether you run Rapid7 Metasploit Framework. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Rapid7 has merged the fix in PR #21880 (commit applies File.basename or separator scrubbing to path entries)

Do not run the ios_image_gather module against untrusted or potentially compromised iOS devices; restrict execution of Metasploit post modules to trusted targets only.

Technical details

The ios_image_gather post module passes unsanitized file names from remote directory listings directly to the file download function without path traversal checks, allowing relative path sequences like ../../ to escape the intended loot directory. An attacker-controlled iOS device can exploit this to overwrite ~/.msf4/msfconsole.rc, a resource file automatically executed at Metasploit startup, or load a malicious Ruby plugin for code execution. The fix applies the same path separator scrubbing used in the recursive downloader to sanitize listing entries before constructing local file paths.

Affected products

Rapid7 Metasploit Framework

Timeline

2026-10-12: disclosed
2026-09-14: patched: PR #21880 merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.