CVE-2026-87690 | Rapid7 Metasploit Framework up to 6.5.4 ios_image_gather file.rb client.fs.file.download_file path traversal

October 12, 2026 Yanac

A vulnerability, which was classified as very critical, was found in Rapid7 Metasploit Framework up to 6.5.4. Affected by this issue is the function client.fs.file.download_file of the file lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb of the component ios_image_gather. Executing a manipulation can lead to path traversal.

The identification of this vulnerability is CVE-2026-87690. The attack may be launched remotely. There is no exploit available.

You should upgrade the affected component.VulDB Recent EntriesRead More