CVE-2026-121451

    Dashboard / Vulnerabilities / CVE-2026-121451

    CVE-2026-121451

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF

    Details: AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121451.json, https://nvd.nist.gov/vuln/detail/CVE-2026-121451, https://www.vulncheck.com/advisories/ab-download-manager-before-1.11.2-arbitrary-file-write-via-start-headless-download-csrf, https://github.com/amir1376/ab-download-manager/issues/1489, https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc, https://github.com/amir1376/ab-download-manager, https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88, https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -14a947bf112c71a32d2f0d0089dcf928493feda8

    Affected versions

    v1.11.1
    v1.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121451 | CVE-DB