StackRadar

CVE-2025-11966

Medium

Advisory

Published 22 Oct 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
4.9
base score, highest
EPSS
0.003
19th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
67
of 17,781 indexed, latest versions
Container images
59
deployed by those charts
Fix available
1 of 1
affected package

Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names

Carried by container images the latest versions of 67 of 17,781 indexed charts deploy, on 59 images.

Affected packageAffected versionsFixed inImages
vertx-webmaven3.4.1, 3.5.4, 3.9.1, 3.9.3+26 more4.5.22, 5.0.559
OSV records
GHSA-45p5-v273-3qqr

Charts affected

67 by stars
ChartLatestAffected imagesRadar Score
apicurioone-acre-fundVerified publisher2.3.03 of 5See more

apicurio one-acre-fund 2.3.0

3 of the 5 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
apicurio/apicurio-studio-api:0.2.62.Final302d202ed149
vertx-web@4.3.7
4.5.22
apicurio/apicurio-studio-ui:0.2.62.Final349c845270c2
vertx-web@4.3.7
4.5.22
apicurio/apicurio-studio-ws:0.2.62.Final27a91978a388
vertx-web@4.3.7
4.5.22

Open the chart page →

18,667
raspberrymaticopenccuVerified publisher3.83.61 of 1See more

raspberrymatic openccu 3.83.6

1 of the 1 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
vertx-web@4.1.3
4.5.22

Open the chart page →

2,421
p4p40.1.01 of 7See more

p4 p4 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
mastercloudapps/server:v2.23f3d24dfe2686
vertx-web@4.3.4
4.5.22

Open the chart page →

27,537
keycloakpascaliskeVerified publisher0.2.01 of 1See more

keycloak pascaliske 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.0.74388e2379b7e
vertx-web@4.5.10
4.5.22

Open the chart page →

2,097
Practica_4_helmpr04helm0.1.01 of 7See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
vertx-web@4.3.4
4.5.22

Open the chart page →

27,558
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
vertx-web@4.5.7
4.5.22

Open the chart page →

21,211
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
vertx-web@4.4.6
4.5.22

Open the chart page →

5,269
keycloaksb-helm-charts0.3.01 of 2See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.0.6a93d22e13b86
vertx-web@4.5.10
4.5.22

Open the chart page →

2,590
keycloaksikalabs0.1.01 of 1See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.3.36a7217a100bd
vertx-web@4.5.18
4.5.22

Open the chart page →

1,690
simple-keycloaksikalabs0.1.01 of 1See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.18830f76112b6
vertx-web@4.3.4
4.5.22

Open the chart page →

6,443
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
vertx-web@4.5.14
4.5.22

Open the chart page →

3,153
wonder-mesh-netstrrl-helm2026.629.01 of 3See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.009a381c715ab
vertx-web@4.5.10
4.5.22

Open the chart page →

5,063
krokiteochenglim1.0.11 of 5See more

kroki teochenglim 1.0.1

1 of the 5 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
yuzutech/kroki:0.17.0192b7b27c857
vertx-web@4.2.6
4.5.22

Open the chart page →

8,715
hermestoukVerified publisher0.6.01 of 3See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
vertx-web@3.9.6
4.5.22

Open the chart page →

12,455
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.1.4044a457e0498
vertx-web@4.5.11
4.5.22

Open the chart page →

45,239
apicurio-registry-sqlwitcom-gmbh0.1.01 of 1See more

apicurio-registry-sql witcom-gmbh 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-jpa:1.3.2.Final44eeddd3562c
vertx-web@3.9.3
4.5.22

Open the chart page →

3,424
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-11966.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
vertx-web@4.3.4
4.5.22

Open the chart page →

6,016

Container images carrying it

59 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
codeurjc/server:v1.0310bea5b1ee7
vertx-web@4.3.4
4.5.22
8
mastercloudapps/server:v2.23f3d24dfe2686
vertx-web@4.3.4
4.5.22
4
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
vertx-web@4.2.7
4.5.22
2
quay.io/keycloak/keycloak:26.1.4044a457e0498
vertx-web@4.5.11
4.5.22
2
quay.io/keycloak/keycloak:20.0054ef67eb7da
vertx-web@4.3.4
4.5.22
2
aktosecurity/akto-threat-detection-backend:latest15ebb75b94dc
vertx-web@4.5.11
4.5.22
1
aktosecurity/akto-threat-detection-backend:1.15.7a6c1b933517f
vertx-web@4.5.11
4.5.22
1
apache/bookkeeper:4.14.5a7d9970c148f
vertx-web@3.9.8
4.5.22
1
apachepulsar/pulsar:3.1.016f9fdab3fa6
vertx-web@4.3.8
4.5.22
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
vertx-web@3.9.8
4.5.22
1
apachepulsar/pulsar:2.6.14db6ff0b4045
vertx-web@3.4.1
4.5.22
1
apachepulsar/pulsar:3.0.79c9947de139d
vertx-web@4.5.10
4.5.22
1
apachepulsar/pulsar:2.9.0d056c89b7131
vertx-web@3.9.8
4.5.22
1
apachepulsar/pulsar:2.8.2d538416d5afe
vertx-web@3.9.8
4.5.22
1
apicurio/apicurio-registry-jpa:1.3.2.Final44eeddd3562c
vertx-web@3.9.3
4.5.22
1
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
vertx-web@3.9.6
4.5.22
1
apicurio/apicurio-studio-api:0.2.62.Final302d202ed149
vertx-web@4.3.7
4.5.22
1
apicurio/apicurio-studio-ui:0.2.62.Final349c845270c2
vertx-web@4.3.7
4.5.22
1
apicurio/apicurio-studio-ws:0.2.62.Final27a91978a388
vertx-web@4.3.7
4.5.22
1
bitnamilegacy/keycloak:20.0.5cb04e49e6eb1
vertx-web@4.3.4
4.5.22
1
bitnamilegacy/keycloak:24.0.4cc599cbd15ff
vertx-web@4.5.7
4.5.22
1
bitnamilegacy/keycloak:26.3.3-debian-12-r0da3df0976a9f
vertx-web@4.5.18
4.5.22
1
confluentinc/cp-kafka-rest:6.1.0b0b7aa26254a
vertx-web@3.9.1
4.5.22
1
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
vertx-web@4.4.6
4.5.22
1
confluentinc/cp-ksqldb-server:6.1.0ee403d5b9090
vertx-web@3.9.1
4.5.22
1
confluentinc/cp-schema-registry:6.1.0b651d4b6185a
vertx-web@3.9.1
4.5.22
1
consensys/teku:25.4.1bf6ecd2ea716
vertx-web@4.5.14
4.5.22
1
esperotech/yaade:latest24d2d692d948
vertx-web@4.5.1
4.5.22
1
folioci/mod-aes:latest6d67e9564270
vertx-web@4.0.3
4.5.22
1
folioci/mod-authtoken:latest995a25a33133
vertx-web@4.5.13
4.5.22
1
folioci/mod-codex-ekb:latest235a3fa4adc9
vertx-web@4.3.3
4.5.22
1
folioci/mod-codex-inventory:latest6d53ed758fd1
vertx-web@4.1.0.CR1
4.5.22
1
folioci/mod-codex-mux:latestd4138abfd30d
vertx-web@4.3.4
4.5.22
1
folioci/mod-data-import-converter-storage:latest3028f333778f
vertx-web@4.3.4
4.5.22
1
folioci/mod-inventory-update:latestba84812b4d58
vertx-web@5.0.4
5.0.5
1
folioci/mod-marccat:latest1b57d690d568
vertx-web@3.5.4
4.5.22
1
folioci/mod-rtac:latestc959b2d6142f
vertx-web@5.0.4
5.0.5
1
graviteeio/ae-engine:3.0.24140932887e0
vertx-web@4.5.21
4.5.22
1
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
vertx-web@4.5.0
4.5.22
1
thmmniii/fbs-runner:v1.27.186105349c1a3
vertx-web@3.9.1
4.5.22
1
viniciusfcf/gitops-quarkus-app-jvm:latestbba8ee1b5cd5
vertx-web@4.3.2
4.5.22
1
yuzutech/kroki:0.17.0192b7b27c857
vertx-web@4.2.6
4.5.22
1
ghcr.io/damap-org/damap-backend:5.0.0f3d0c7d35498
vertx-web@4.5.7
4.5.22
1
ghcr.io/devops-ia/kafka-cruise-control:jdk17-cc2.5.146-iam2.3.8e310642de2e2
vertx-web@4.5.8
4.5.22
1
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
vertx-web@4.1.3
4.5.22
1
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
vertx-web@5.0.4
5.0.5
1
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
vertx-web@4.5.7
4.5.22
1
quay.io/apicurio/apicurio-registry-kube-sync:1.0.170ef31840269
vertx-web@4.1.5
4.5.22
1
quay.io/apicurio/apicurio-registry-mem:2.5.8.Final3b036692d546
vertx-web@4.4.6
4.5.22
1
quay.io/keycloak/keycloak:26.009a381c715ab
vertx-web@4.5.10
4.5.22
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.