CVE-2025-11146

MEDIUM 5.4CVE-2025-11146 · Published 29/09/2025 · updated 19/10/2026

In short

CVE-2025-11146 is a MEDIUM (CVSS 5.4) vulnerability affecting apt-cacher-ng (apt-cacher-ng project).
Chance of exploitation in the next 30 days (EPSS): 0.18%, higher than 7.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
apt-cacher-ng apt-cacher-ng_project	`= 3.2-1`	No fix yet

Description

Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in “/acng-report.html”.

References

incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apt-cacher-ng · Third Party Advisory

More vulnerabilities in apt-cacher-ng

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apt-cacher-ng

apt-cacher-ng_project

= 3.2-1

No fix yet

More vulnerabilities in apt-cacher-ng

See all →