{"id":"CVE-2026-121451","title":"AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF","summary":"AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-352"],"vendor":"amir1376","product":"ab-download-manager","affected":["ab-download-manager < 1.11.2"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T15:17:01.146Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121451","references":[{"url":"https://github.com/amir1376/ab-download-manager/issues/1489","label":"GitHub Issue #1489"},{"url":"https://github.com/amir1376/ab-download-manager"},{"url":"https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc","label":"Fix commit"},{"url":"https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75"},{"url":"https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88"},{"url":"https://www.vulncheck.com/advisories/ab-download-manager-before-1.11.2-arbitrary-file-write-via-start-headless-download-csrf","label":"VulnCheck Advisory: AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF"}],"tags":["cve.org"],"epss":0.0029,"epssPercentile":0.21718,"ingestedAt":"2026-11-05T19:30:42.974Z","slug":"CVE-2026-121451","body":"## Overview\n\nAB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.\n\n## Affected\n\n- `ab-download-manager < 1.11.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}