{"id":"CVE-2026-121451","published":"2026-11-03T16:17:23.960","lastModified":"2026-11-03T16:30:49.290","description":"AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://github.com/amir1376/ab-download-manager","tags":[]},{"url":"https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88","tags":[]},{"url":"https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75","tags":[]},{"url":"https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc","tags":[]},{"url":"https://github.com/amir1376/ab-download-manager/issues/1489","tags":[]},{"url":"https://www.vulncheck.com/advisories/ab-download-manager-before-1.11.2-arbitrary-file-write-via-start-headless-download-csrf","tags":[]}],"exploitRefs":[{"url":"https://github.com/amir1376/ab-download-manager","tags":[]},{"url":"https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88","tags":[]},{"url":"https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75","tags":[]},{"url":"https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc","tags":[]},{"url":"https://github.com/amir1376/ab-download-manager/issues/1489","tags":[]}],"hasPoc":true,"ai":{"summary":"AB Download Manager before 1.11.2 exposes an unauthenticated browser-integration API endpoint (/start-headless-download) vulnerable to CSRF, allowing attackers to trick users into writing arbitrary files to disk, including placing malicious payloads in startup folders for code execution.","exploitability":"Exploitation requires user interaction (e.g., visiting a malicious webpage) and relies on the victim's browser sending a forged request to the vulnerable endpoint without authentication or CSRF protection.","blast_radius":"Successful exploitation enables remote code execution upon user login, compromising confidentiality, integrity, and availability of the affected system.","remediation":"Upgrade to AB Download Manager version 1.11.2 or later, which patches the CSRF vulnerability in the unauthenticated API endpoint.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","rce","web","unauth-api","file-write"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:57:40.667Z"}}