AB Download Manager arbitrary file write via cross-site request forgery

A malicious web page you visit can plant files on your PC through a download app.

Summary

AB Download Manager before 1.11.2 lets a malicious web page write files to arbitrary paths through its unauthenticated browser-integration API. Files placed in startup folders can run code at the next login.

What to do

Update to 1.11.2 or later.

Products and platforms

Windows
macOS
Linux
ab-download-manager

CVE IDs

CVE-2026-121451 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 15:17 UTC

First seen 2026-11-09 14:50 UTC