Netbox · Netbox · CVE-2026-104073
**Name of the Vulnerable Software and Affected Versions**
NetBox versions 2.9.5 through 4.6.x
**Description**
A server-side template injection occurs because the raw Django HttpRequest object is exposed to the Jinja2 template context. A low-privileged user with the "Can add custom links" permission can exploit this by crafting a custom link template that embeds `request.COOKIES['sessionid']` or an API token into an img src URL. This technique bypasses the `clean html` sanitizer, allowing the automatic exfiltration of a privileged user's session cookies and API tokens to an external host when the object is viewed, which can lead to full account takeover.
**Recommendations**
Update NetBox to version 4.7.0 or later.
Restrict the "Can add custom links" permission to trusted users only.