CVE-2006-0848

macOS X - Remote Code Execution via Safari Safe Files Download Feature

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2006-0848. PoCs published by Metasploit, hdm, including Metasploit module exploits/osx/browser/safari_metadata_archive.

AI-analyzed exploit summary This Metasploit module exploits CVE-2006-0848 in Safari by crafting a malicious ZIP archive with a shell script and metadata to force execution via Terminal.app. It requires the 'zip' utility and targets macOS Safari users.

Description

The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremoteunix
https://www.exploit-db.com/exploits/16866

This Metasploit module exploits CVE-2006-0848 in Safari by crafting a malicious ZIP archive with a shell script and metadata to force execution via Terminal.app. It requires the 'zip' utility and targets macOS Safari users.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Safari (macOS, versions unspecified)
No auth needed
Prerequisites: zip command-line utility · victim interaction (downloading and opening the archive)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by hdm · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/safari_metadata_archive.rb

This Metasploit module exploits a command execution flaw in Safari's 'Safe file' feature by delivering a malicious ZIP archive containing a shell script disguised as a .mov file with metadata to trigger Terminal.app execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Safari (versions up to 2.0.2)
No auth needed
Prerequisites: Attacker must host the malicious ZIP file on an HTTP server · Victim must download and open the ZIP file in Safari
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (13)

Core 13
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/16736
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/0671
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/18963
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/999708
Exploit vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1015652
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA06-053A.html
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA06-062A.html
Various Sources x_refsource_misc
http://www.heise.de/english/newsticker/news/69862
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/23510
Vendor Advisory x_refsource_confirm
http://docs.info.apple.com/article.html?artnum=303382
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/24808

Scores

EPSS 0.5810
EPSS Percentile 99.0%

Details

CWE
CWE-16
Status published
Products (2)
apple/mac_os_x 10.4.5
apple/mac_os_x_server 10.4.5
Published Feb 22, 2006
Tracked Since Feb 18, 2026