CVE-2026-87690

CVE-2026-87690 is a relative path traversal vulnerability (CWE-22) affecting the `post/apple_ios/gather/ios_image_gather` post-exploitation module in the Rapid7 Metasploit Framework. The issue arises because the module interpolates file names retrieved from a Meterpreter directory listing—which can be fully controlled by a hostile or tampered iOS device—directly into the local destination path without proper sanitization. Because the underlying file-writing function writes to any supplied path, directory traversal sequences (such as `../`) can allow files to be written outside of the intended `~/.msf4/loot/` directory. An attacker controlling a compromised iOS device can exploit this flaw by luring a Metasploit operator into running the affected gather module. This allows the attacker to overwrite local files on the operator's workstation, specifically targeting the `~/.msf4/msfconsole.rc` resource file, which automatically executes at startup. By writing malicious Ruby code or loading a custom plugin through this file, the attacker can achieve persistent code execution with the operator's privileges upon the next launch of the console. The vulnerability has been addressed in Metasploit Framework version 6.5.5 and later by applying sanitization to directory listing entries.