Vulnerability record · CVE-2006-0848 · published 22 February 2006
CVE-2006-0848: Safari 'Open safe files' option allows arbitrary command execution via __MACOSX metadata
Apple · Mac Os X
Safari on Apple Mac OS X, when the "Open 'safe' files after downloading" option is enabled, processes a __MACOSX folder inside a downloaded archive and follows its resource fork metadata. That metadata can invoke Terminal, which interprets an embedded script with bash, so a crafted ZIP with a script using a safe file extension leads to command execution. The flaw matters because it turns a routine download into a code execution path on the user's machine.
Description
The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension.
AV:N/AC:H/Au:N/C:P/I:P/A:P
Automated analysis
high priorityPublic exploit references and a very high EPSS score indicate active interest, though exploitation requires user interaction and the vulnerable Safari option to be enabled.
What it is
Safari on Apple Mac OS X, when the "Open 'safe' files after downloading" option is enabled, processes a __MACOSX folder inside a downloaded archive and follows its resource fork metadata. That metadata can invoke Terminal, which interprets an embedded script with bash, so a crafted ZIP with a script using a safe file extension leads to command execution. The flaw matters because it turns a routine download into a code execution path on the user's machine.
Impact
An attacker can execute arbitrary commands with the privileges of the logged-in user, leading to data theft, persistence, or further compromise of the host.
Attack surface
Reached remotely over the network by delivering a crafted archive that the user downloads in Safari; no authentication is required, but the attack depends on user interaction and on the "Open 'safe' files after downloading" option being enabled.
Exploitation
Not listed in CISA KEV, but multiple references are tagged Exploit and EPSS is 0.58105 (99th percentile), indicating public exploit material and elevated predicted activity.
What to do
- Patch Safari and Mac OS X using the vendor advisory (Apple article 303382) and apply the associated security updates.
- Disable the "Open 'safe' files after downloading" option in Safari preferences.
- Block or quarantine archive downloads containing __MACOSX metadata or resource forks at the mail and web gateway.
- Educate users not to open unexpected ZIP or archive attachments from untrusted sources.
- Where feasible, restrict Terminal execution for non-administrative users.
Detection
- Monitor for Terminal or bash processes spawned by Safari or by archive extraction utilities.
- Alert on downloads or email attachments containing __MACOSX directories or resource fork metadata.
- Review endpoint process trees for Safari launching shell interpreters shortly after a file download.
- Audit Safari preferences to confirm the safe-files auto-open option is disabled.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-0848 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-0848), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
