{"id":"CVE-2026-121451","kind":"vulnerability","aliases":["CVE-2026-121451"],"related":[],"title":"AB Download Manager: web pages can write files to any path","description":"AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.","summary":"AB Download Manager before 1.11.2 accepts unauthenticated requests from its browser integration API, so a malicious web page can make the user's browser send a request that writes attacker-chosen files to arbitrary paths. An attacker can place payloads in startup folders to run code on the next login.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ab-download-manager","browser-integration","desktop","package","windows"],"not_affected_if":["browser-integration-disabled","version-1.11.2-or-later"],"how_to_check":"- Check the installed AB Download Manager version in its About screen or package metadata; versions below `1.11.2` are in scope.\n- Confirm whether the browser integration API is enabled on the machine.","fix":"- AB Download Manager: `1.11.2` or later (per the advisory range 'before 1.11.2').","status":"open","published_at":"2026-11-03T16:17:23+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:23:37+00:00","updated_at":"2026-11-03T16:23:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:23:37Z","model":"claude-haiku-5-5","output":{"fix":"- AB Download Manager: `1.11.2` or later (per the advisory range 'before 1.11.2').","reach":"local","title":"AB Download Manager: web pages can write files to any path","impact":"high","summary":"AB Download Manager before 1.11.2 accepts unauthenticated requests from its browser integration API, so a malicious web page can make the user's browser send a request that writes attacker-chosen files to arbitrary paths. An attacker can place payloads in startup folders to run code on the next login.","audience":"everyone","category":"package","nicknames":[],"who_cares":["ab-download-manager","desktop","windows","browser-integration"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker writes startup files and runs code on next login","analyst_note":"Confirm the affected platforms and default state of the browser integration API at the vulnerability record (vulncheck advisory) and the patch on github.com.","how_to_check":"- Check the installed AB Download Manager version in its About screen or package metadata; versions below `1.11.2` are in scope.\n- Confirm whether the browser integration API is enabled on the machine.","plain_action":"Update AB Download Manager to version 1.11.2 or later.","needs_analyst":true,"not_affected_if":["version-1.11.2-or-later","browser-integration-disabled"],"who_is_affected":"Desktop users running AB Download Manager before 1.11.2 with its browser integration enabled. Exposure comes from visiting a malicious web page while the app is running, so machines without the app or with the integration off can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4183,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121451':14A,17A '-2026':13A,16A '/start-headless-download':122C '1.11.2':32B,83C 'ab':1A,19B,28B,79C 'ab-download-manag':18B 'accept':33B 'allow':100C 'api':40B,98C 'arbitrari':62B,110C 'attack':58B,65B,102C,106C 'attacker-chosen':57B,105C 'browser':23B,38B,51B,96C 'browser-integr':22B,95C 'chosen':59B,107C 'code':74B,135C 'contain':84C 'craft':124C 'cross':87C 'cross-sit':86C 'cve':12A,15A 'desktop':25B 'download':2A,20B,29B,80C 'execut':136C 'file':8A,60B,108C 'folder':71B,125C,133C 'forgeri':90C 'integr':24B,39B,97C 'login':78B,139C 'make':47B 'malici':43B,113C 'manag':3A,21B,30B,81C 'name':127C 'next':77B,138C 'packag':26B 'page':5A,45B,115C 'path':11A,63B,111C 'payload':68B,130C 'place':67B,129C 'remot':101C 'request':35B,54B,89C,120C 'run':73B 'send':52B,117C 'site':88C 'startup':70B,132C 'text/plain':119C 'unauthent':34B,94C 'user':49B 'valu':128C 'vulner':91C 'web':4A,44B,114C 'window':27B 'write':7A,56B,104C","nicknames":[],"mitigations":[],"who_affected":"Desktop users running AB Download Manager before 1.11.2 with its browser integration enabled. Exposure comes from visiting a malicious web page while the app is running, so machines without the app or with the integration off can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update AB Download Manager to version 1.11.2 or later.","pkeys":[],"ptokens":[],"labels":["abdownloadmanager","browserintegration","desktop","high","package","windows"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121451","severity":null,"published_at":"2026-11-03T16:17:23+00:00","modified_at":"2026-11-03T16:17:23+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null}],"documents":[{"id":58811,"url":"https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58812,"url":"https://www.vulncheck.com/advisories/ab-download-manager-before-1.11.2-arbitrary-file-write-via-start-headless-download-csrf","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}