Metasploit Framework EUVD-2026-97177

Exploitation requires three concrete prerequisites drawn from the description: (1) the operator must have an active Meterpreter session to an attacker-controlled or tampered iOS device; (2) the operator must run the specific post module post/apple_ios/gather/ios_image_gather; and (3) the hostile device must return a directory listing containing a crafted filename with traversal sequences (e.g. ../../msfconsole.rc) that the module interpolates unsanitized into client.fs.file.download_file(). Limiting factors: this is not remote-unauthenticated against a default service - it demands operator user interaction (UI:R), control over the connected device, and that the target runs Metasploit versions prior to 6.5.5. No authentication on the workstation is needed (PR:N), and the written msfconsole.rc only executes at the next msfconsole launch.

Signals conflict on how urgent this is. The CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) looks severe, and the outcome is genuinely serious: an arbitrary file write that converts into persistent code execution and an interactive shell as the Metasploit operator, who is frequently running as root on the pentester workstation. However, the exploitation-probability signals are muted or absent: no CISA KEV listing, no public exploit code identified, and no EPSS score was provided in the input, so there is no evidence of broad or opportunistic exploitation. The AC:L in the NVD vector arguably understates reality, since a successful attack requires an attacker-controlled or tampered iOS device, a Meterpreter session established to it, and social engineering to lure the operator into running one specific post module (post/apple_ios/gather/ios_image_gather). This is a targeted, operator-in-the-loop attack against a tooling niche rather than a mass-exploitable internet-facing flaw. Net assessment: a real and worth-patching issue for anyone running Metasploit against untrusted iOS devices, but not an emergency widespread-exploitation priority. Fixed upstream in release 6.5.5 (PR 21880), so remediation is straightforward.

A penetration tester opens a Meterpreter session to an iOS device that is actually attacker-controlled or tampered and runs the ios_image_gather post module. The device returns a directory listing containing a crafted entry such as ../../msfconsole.rc, which the unsanitized download path writes outside the intended loot directory, overwriting the operator's startup resource file; a companion written Ruby plugin then executes the next time msfconsole launches, yielding code execution as the operator (often root). No public POC was identified at time of analysis, though the fixing PR diff publicly illustrates the vulnerable sink; exploitation requires user interaction (UI:R) but no privileges on the workstation.