CVE-2025-11146

MediumCVSS 5.4

Published: 29/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Reflected cross-site scripting (XSS) exists in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts in the web management application due to improper handling of GET inputs in "/acng-report.html".

Risk Assessment

An attacker could execute malicious script in a victim's browser, risking session theft or actions performed on the user's behalf. Users of the Apt-Cacher-NG web panel are at risk.

Recommendation

Update Apt-Cacher-NG to a patched version or restrict access to "/acng-report.html". Validate and filter GET parameters on the application side.

Other vulnerabilities in Apt-Cacher-NG

CVE-2025-11147Medium
Reflected cross-site scripting (XSS) exists in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts to be executed via "/html/<filename>.html".

Original NVD description (English source)

Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in “/acng-report.html”.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS