AB Download Manager: Unauthenticated arbitrary file write via CSRF (CVE-2026-121451)

AB Download Manager versions before 1.11.2 contain a cross-site request forgery (CSRF) vulnerability in the browser-integration API endpoint /start-headless-download. This vulnerability allows an unauthenticated attacker to write arbitrary files to locations on the user's system, including startup folders, to achieve code execution.

Attack Chain

1. Attacker hosts a malicious webpage containing a cross-site request forgery (CSRF) payload.
2. A targeted user with AB Download Manager installed navigates to the malicious webpage.
3. The browser automatically sends a cross-site POST request to the local AB Download Manager API at /start-headless-download.
4. The API processes the request due to the lack of CSRF protection.
5. The attacker-controlled parameters ("folder" and "name") are used to write a file to an arbitrary path on the host filesystem.
6. If a payload is written to a system startup directory, it executes upon the user's next login or reboot.

Recommendation

• Upgrade AB Download Manager to version 1.11.2 or later immediately.
• Patching information is available via the project repository: https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc.