{"slug": "metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles", "title": "Metasploit Wrap Up: Lot of summer shells and fit http profiles", "summary": "Rapid7's Metasploit Framework 6.5 release adds 13 new modules, including exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, Pix-for-WooCommerce, and the Fragnesia Linux kernel LPE (CVE-2026-46300). The update also introduces HTTP malleable profiles, MCP functionality, Linux multi fetch payloads, and AArch64 reverse-TCP shells for Windows on ARM. Notable vulnerabilities addressed include CVE-2025-49132 in Pterodactyl Panel before 1.11.11 and CVE-2026-15409 in SonicWall SMA1000 WorkPlace wsproxy.", "body_md": "This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE (CVE-2026-46300). Metasploit also got the glow-up of the summer with the new http malleable profiles, MCP functionality and linux multi fetch payloads (more details on the [official 6.5 release blog post](https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released/)!). Windows on ARM confirm to be the new first-class citizenship thanks to brand-new AArch64 reverse-TCP shells (both inline and staged), so your Snapdragon boxes can join the party too. Last but not least, an important message: *Nyan Nyan Nyan Nyan Nyan Nyan.*\n\nAuthor: Richard Howe <rhowe425>\n\nType: Auxiliary\n\nPull request: [#21681](https://github.com/rapid7/metasploit-framework/pull/21681) contributed by [rmhowe425](https://github.com/rmhowe425)\n\nPath: `gather/ray_dashboard_logs_api_path_traversal`\n\nDescription: This adds an auxiliary module that leverages a path traversal vulnerability in Ray to list the contents of local directories. There is currently no CVE assigned to this vulnerability. Issuance is pending with MITRE.\n\nAuthors: 0xtensho and jheysel-r7\n\nType: Exploit\n\nPull request: [#21452](https://github.com/rapid7/metasploit-framework/pull/21452) contributed by [jheysel-r7](https://github.com/jheysel-r7)\n\nPath: `linux/http/pterodactyl_locales_locale_json`\n\nAttackerKB reference: [CVE-2025-49132](https://attackerkb.com/search?q=CVE-2025-49132&referrer=blog)\n\nDescription: This adds a module which exploits a vulnerability in Pterodactyl Panel before version 1.11.11 that allows unauthenticated remote code execution through improper handling of locale file operations. The vulnerability, CVE-2025-49132, exists in the locale.json endpoint which allows path traversal and arbitrary file creation. This combination of capabilities results in remote code execution in the context of the user running the web server.\n\nAuthors: Deral Heiland, Rapid7 Vulnerability Research, and Ryan Emmons\n\nType: Exploit\n\nPull request: #[21678](https://github.com/rapid7/metasploit-framework/pull/21678) contributed by dheiland-r7(https://github.com/dheiland-r7)\n\nPath: `linux/http/sonicwall_sma1000_wsproxy_rce`\n\nAttackerKB reference:[ CVE-2026-15409](https://attackerkb.com/search?q=CVE-2026-15409&referrer=blog)\n\nDescription: This adds a new exploit module for CVE-2026-15409, a Server-Side Request Forgery (SSRF) vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service.\n\nAuthors: William Bowling and msutovsky-r7\n\nType: Exploit\n\nPull request: [#21456](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21456) contributed by [msutovsky-r7](https://github.com/msutovsky-r7)\n\nPath: linux/local/cve_2026_46300_fragnesia\n\nAttackerKB reference: [CVE-2026-46300](https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-46300%26referrer%3Dblog)\n\nDescription: This adds a local module for the Fragnesia exploit which is a page-cache replacement vulnerability in the Linux kernel's XFRM (IPsec) subsystem, tracked as CVE-2026-46300.\n\nAuthors: Cristian-Alexandru Staicu and Maksim Rogov\n\nType: Exploit\n\nPull request: [#21234](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21234) contributed by [vognik](https://github.com/vognik)\n\nPath: multi/http/ghostcms_auth_rce_cve_2026_29053\n\nAttackerKB reference: [CVE-2026-22594](https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-22594%26referrer%3Dblog)\n\nDescription: This adds an exploit module for Ghost CMS (CVE-2026-29053) that achieves remote code execution by uploading a malicious theme. Ghost's theme renderer evaluates untrusted JSONPath expressions through the {{#get}} helper, letting the module inject and trigger arbitrary code once a theme is uploaded and activated. You'll need valid admin or staff credentials to authenticate.\n\nAuthors: David Jardin, Uwe Flottemesch, and ispyispyispy\n\nType: Exploit\n\nPull request: [#21615](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21615) contributed by [15py15py15py](https://www.google.com/search?q=https://github.com/15py15py15py)\n\nPath: multi/http/joomla_com_jce_unauth_file_upload_rce\n\nAttackerKB reference: [CVE-2026-48907](https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-48907%26referrer%3Dblog)\n\nDescription: This adds a new exploit module for CVE-2026-48907, an unauthenticated arbitrary profile creation vulnerability in the JCE (Joomla Content Editor) extension for Joomla!. The profiles.import task fails to enforce authentication, letting an attacker import a crafted profile that is written to disk as a PHP web shell, resulting in remote code execution when the tmp/ directory is directly accessible. All JCE versions up to and including 2.9.99.4 are affected, and no credentials are required.\n\nAuthors: Diamorphine and Richard Howe\n\nType: Exploit\n\nPull request: [#21700](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21700) contributed by [rmhowe425](https://github.com/rmhowe425)\n\nPath: multi/http/langflow_unauth_rce_cve_2026_33017\n\nAttackerKB reference: [CVE-2026-33017](https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-33017%26referrer%3Dblog)\n\nDescription: Adds a new multi/http/langflow_unauth_rce_cve_2026_33017 exploit module that exploits an unauth RCE vulnerability in the /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow versions prior to 1.9.0.\n\nAuthors: Chocapikk and stlthr4k3r\n\nType: Exploit\n\nPull request: [#21630](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21630) contributed by [stlthr4k3r](https://github.com/stlthr4k3r)\n\nPath: multi/http/opencats_installer_rce\n\nAttackerKB reference: [CVE-2026-27760](https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-27760%26referrer%3Dblog)\n\nDescription: Adds an exploit module targeting CVE-2026-27760, a PHP code injection in OpenCATS.\n\nAuthors: Adam Kues, Crypto-Cat, TF1T, dtro, and haongo\n\nType: Exploit\n\nPull request: [#21686](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21686) contributed by [Crypto-Cat](https://github.com/Crypto-Cat)\n\nPath: multi/http/wp_batch_desync_rce\n\nAttackerKB reference: [CVE-2026-60137](https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-60137%26referrer%3Dblog)\n\nDescription: This adds an exploit module to target WP2Shell, an unauthenticated pre-auth remote code execution vulnerability affecting WordPress core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The module chains a REST API route confusion flaw (CVE-2026-63030) with an SQL injection (CVE-2026-60137) to elevate privileges, deploy a payload via a custom plugin, and execute a remote session.\n\nAuthors: Alexis Lafontaine and Maksim Rogov\n\nType: Exploit\n\nPull request: [#21683](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21683) contributed by [vognik](https://github.com/vognik)\n\nPath: multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891\n\nAttackerKB reference: [CVE-2026-3891](https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-3891%26referrer%3Dblog)\n\nDescription: Adds CVE-2026-3891 WordPress Unauthenticated RCE Exploit module targeting Pix for WooCommerce plugin.\n\nAuthors: OJ Reeves, Spencer McIntyre\n\nType: Payload (Single) Pull request: [#21728](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21728) contributed by [zeroSteiner](https://github.com/zeroSteiner)\n\nDescription: Adds support for a new MALLEABLEC2 option to Meterpreter HTTP(S) payloads. This feature enables users to load a standard profile into Meterpreter and change the shape of its HTTP(S) traffic. All Meterpreters, including Windows, Java, Python, PHP and Linux, have been updated with this functionality.\n\nAuthor: vinicius-batistella\n\nType: Payload (Single)\n\nPull request: [#21589](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21589) contributed by [vinicius-batistella](https://github.com/vinicius-batistella)\n\nPath: windows/aarch64/shell_reverse_tcp\n\nDescription: Adds Windows on ARM (AArch64) reverse-TCP command-shell payload.\n\nAuthor: vinicius-batistella\n\nType: Payload (Stager)\n\nPull request: [#21744](https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21744) contributed by [vinicius-batistella](https://github.com/vinicius-batistella)\n\nPath: windows/aarch64/shell/reverse_tcp\n\nDescription: Adds Windows AARCH64 staged shell payloads.\n\nYou can find the latest Metasploit documentation on our docsite at [docs.metasploit.com](https://docs.metasploit.com/).\n\nAs always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:\n\nIf you are a git user, you can clone the [Metasploit Framework repo](https://www.google.com/search?q=%5Bhttps%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%5D%28https%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%29) (master branch) for the latest. To install fresh without using git, you can use the open-source-only [Nightly Installers](https://www.google.com/search?q=%5Bhttps%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%2Fwiki%2FNightly-Installers%5D%28https%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%2Fwiki%2FNightly-Installers%29) or the commercial edition [Metasploit Pro](https://www.google.com/search?q=%5Bhttps%3A%2F%2Fwww.rapid7.com%2Fproducts%2Fmetasploit%2Fdownload%2F%5D%28https%3A%2F%2Fwww.rapid7.com%2Fproducts%2Fmetasploit%2Fdownload%2F%29).", "url": "https://wpnews.pro/news/metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles", "canonical_source": "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles", "published_at": "2026-08-14 21:27:45+00:00", "updated_at": "2026-08-14 22:28:58.619267+00:00", "lang": "en", "topics": ["ai-tools", "ai-infrastructure"], "entities": ["Rapid7", "Metasploit Framework", "WordPress", "Ghost CMS", "Joomla", "Langflow", "OpenCATS", "Pterodactyl Panel"], "alternates": {"html": "https://wpnews.pro/news/metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles", "markdown": "https://wpnews.pro/news/metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles.md", "text": "https://wpnews.pro/news/metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles.txt", "jsonld": "https://wpnews.pro/news/metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles.jsonld"}}