CVE-2025-11147

MediumCVSS 5.4

Published: 29/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Reflected cross-site scripting (XSS) exists in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts to be executed via "/html/<filename>.html".

Risk Assessment

An attacker could execute script in a victim's browser via a crafted link, potentially leading to session theft. Administrators and users of the Apt-Cacher-NG web interface are at risk.

Recommendation

Update Apt-Cacher-NG to a patched version or restrict access to the web interface. Do not open untrusted links pointing to "/html/".

Other vulnerabilities in Apt-Cacher-NG

CVE-2025-11146Medium
Reflected cross-site scripting (XSS) exists in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts in the web management application due to improper handling of GET inputs in "/acng-report.html".

Original NVD description (English source)

Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in “/html/<filename>.html”.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS