Weekly Metasploit Update: Modules for Audiobookshelf, LiteLLM, Next.js, Dalfox and more
2026-06-29T07:23:48Z•0dcbd1cca4974d1fed5d5eeda00991cdaf02cb33365c141952ead77a84a01648
ai-complianceaudiobookshelfcve-2025-25205cve-2026-41679dalfoxdetectiondll-sideloadingdonutdropping-elephantexploit-modulesincident-responseliteLLMmalwarememory-residentmetasploitnext.jsnis2ntlm-relaypaperclipprivilege-escalationsql-injectionunauthenticated-rcexerte
What happened
Rapid7 published multiple Metasploit module updates and research: new scanners and exploit modules include an Audiobookshelf unauthenticated API authentication bypass (CVE-2025-25205), a LiteLLM proxy pre-auth SQL injection scanner, a Next.js middleware authorization bypass scanner, a Dalfox deserialization RCE, and an unauthenticated Paperclip AI full RCE chain (CVE-2026-41679). Additional modules cover arbitrary file upload and NTLM relay local privilege escalation, plus an MCP server integration for AI assistance in msfconsole. Separately, Rapid7 tracked a sophisticated Dropping Elephant AT
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 0dcbd1cca4974d1fed5d5eeda00991cdaf02cb33365c141952ead77a84a01648
- Enrichment time
- 2026-06-29T07:23:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.