{
  "cveId": "CVE-2025-11146",
  "url": "https://patchblox.com/security/cve/CVE-2025-11146",
  "summary": "CVE-2025-11146 is fixed in apt-cacher-ng on 1 platform, first by DEBIAN-CVE-2025-11146, released September 29, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "apt-cacher-ng: Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1",
  "description": "Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in \u201C/acng-report.html\u201D.",
  "published": "2025-09-29T10:15:36Z",
  "severity": "medium",
  "cvss": 5.4,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.0018,
  "epssPercentile": 0.07565,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apt-cacher-ng",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.7.5-1",
      "fix": "DEBIAN-CVE-2025-11146",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-11146",
      "released": "2025-09-29T10:15:36Z"
    },
    {
      "platform": "linux",
      "product": "apt-cacher-ng",
      "release": "Debian 14",
      "fixedVersion": "3.7.5-1",
      "fix": "DEBIAN-CVE-2025-11146",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-11146",
      "released": "2025-09-29T10:15:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}