[ CVE-2026-121451 · Published 3 Nov 2026 ]
Vulnerability in amir1376 ab-download-manager
CVSS 8.8
EPSS <1%No fix listed yet
[ Description ]Official description
AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/amir1376/ab-download-manager
- github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/ab…
- github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin…
- github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc
- github.com/amir1376/ab-download-manager/issues/1489
- www.vulncheck.com/advisories/ab-download-manager-before-1.11.2-arbitrary-file-write-via…