HIGH 8.7 NVD
CVE-2026-121451
AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attacker
AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.
References
- https://github.com/amir1376/ab-download-manager
- https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/c
- https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/k
- https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fe
- https://github.com/amir1376/ab-download-manager/issues/1489
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.