CVE-2025-11146: Apt-Cacher-NG Reflected XSS Vulnerability

CVE-2025-11146 Overview

CVE-2025-11146 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Apt-Cacher-NG version 3.2.1. The flaw resides in the /acng-report.html endpoint of the web management application. Attackers can inject malicious JavaScript through unsanitized GET parameters embedded in the URL. When a targeted user loads the crafted link, the injected script executes in their browser session under the origin of the vulnerable server. The issue is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in an administrator's browser to hijack sessions, steal credentials, or perform actions against the Apt-Cacher-NG web management interface.

Affected Products

Apt-Cacher-NG version 3.2.1
Apt-Cacher-NG web management application (/acng-report.html)
Deployments exposing the Apt-Cacher-NG report interface over the network

Discovery Timeline

2025-09-29 - CVE-2025-11146 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11146

Vulnerability Analysis

Apt-Cacher-NG is a caching proxy for Debian-style software package downloads. Version 3.2.1 exposes a web management interface that includes the /acng-report.html reporting page. This page accepts user-controlled input through GET parameters in the URL.

The application reflects those parameter values into the rendered HTML response without proper output encoding or contextual sanitization. An attacker crafts a URL containing JavaScript payloads in the vulnerable parameters. When a victim, typically an administrator, clicks the link, the browser executes the payload in the security context of the Apt-Cacher-NG host. The reflected nature of the flaw requires user interaction, which aligns with the UI:A attribute in the CVSS v4.0 vector.

Root Cause

The root cause is missing input validation and output encoding on GET parameters processed by the /acng-report.html handler. Server-side code echoes attacker-supplied values into the response body without escaping HTML metacharacters such as <, >, ", and '. This allows arbitrary HTML and JavaScript to be inserted into the DOM of the response page.

Attack Vector

Exploitation follows the standard reflected XSS pattern. An attacker constructs a URL pointing to the target Apt-Cacher-NG instance with a malicious payload appended to a vulnerable GET parameter on /acng-report.html. The attacker delivers this URL through phishing email, chat, or a compromised web page. When the victim visits the link while authenticated to the management interface, the injected script runs. Attacker objectives typically include session cookie theft, forced administrative actions through CSRF chaining, or delivery of secondary payloads targeting the browser.

No authenticated exploitation is required. See the INCIBE Notice on Vulnerabilities for additional technical context.

Detection Methods for CVE-2025-11146

Indicators of Compromise

HTTP GET requests to /acng-report.html containing URL-encoded <script> tags, javascript: URIs, or event handlers such as onerror= and onload=.
Requests with unusually long query strings or non-ASCII payloads directed at the Apt-Cacher-NG reporting endpoint.
Referer headers from unexpected external domains preceding administrator access to /acng-report.html.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters on /acng-report.html for HTML tags, script directives, and encoded XSS payload patterns.
Enable verbose access logging on the Apt-Cacher-NG server and review query strings for suspicious characters, including <, >, %3C, %3E, and javascript:.
Correlate outbound connections from administrator workstations to unknown domains shortly after visits to the Apt-Cacher-NG management interface.

Monitoring Recommendations

Alert on any external network access to the Apt-Cacher-NG web interface, which should typically be restricted to internal management networks.
Monitor browser telemetry on administrator endpoints for unusual JavaScript execution or credential prompts originating from the Apt-Cacher-NG host.
Track version inventory to identify any Apt-Cacher-NG 3.2.1 instances remaining in production.

How to Mitigate CVE-2025-11146

Immediate Actions Required

Restrict network access to the Apt-Cacher-NG web management interface using firewall rules or bind it to loopback only.
Instruct administrators to avoid clicking untrusted links that reference the Apt-Cacher-NG host, especially links pointing at /acng-report.html.
Audit exposed Apt-Cacher-NG deployments and confirm which instances are running the affected 3.2.1 release.

Patch Information

No vendor patch URL is listed in the NVD entry at time of publication. Monitor the INCIBE advisory for Apt-Cacher-NG and upstream project releases for a fixed version beyond 3.2.1. Upgrade as soon as a patched build becomes available.

Workarounds

Block or filter requests to /acng-report.html at a reverse proxy until a patched version is deployed.
Enforce a strict Content Security Policy (CSP) on the Apt-Cacher-NG interface through a fronting proxy to limit inline script execution.
Require administrators to access the management interface only from a dedicated browser profile with no active session cookies for external sites.

bash

# Example: restrict Apt-Cacher-NG web interface to localhost with an nginx reverse proxy
# and block the vulnerable report endpoint until a fix is applied.
server {
    listen 127.0.0.1:3142;
    server_name apt-cacher-ng.internal;

    location = /acng-report.html {
        return 403;
    }

    location / {
        proxy_pass http://127.0.0.1:3143;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    }
}