Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121451AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF

High 8.8

In plain English

A high-severity cross-site request forgery in ab-download-manager from amir1376. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.

Affected products (as reported)

Vendor	Product	Versions
amir1376	ab-download-manager	0 – before 1.11.2

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Issue #1489 issue-tracking
https://github.com/amir1376/ab-download-manager product
Fix commit patch
https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75 technical-description
https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88 technical-description
VulnCheck Advisory: AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF third-party-advisory