CVE-2026-104073

Name of the Vulnerable Software and Affected Versions NetBox versions 2.9.5 through 4.6.x

Description A server-side template injection occurs because the raw Django HttpRequest object is exposed to the Jinja2 template context. A low-privileged user with the "Can add custom links" permission can exploit this by crafting a custom link template that embeds request.COOKIES['sessionid'] or an API token into an img src URL. This technique bypasses the clean html sanitizer, allowing the automatic exfiltration of a privileged user's session cookies and API tokens to an external host when the object is viewed, which can lead to full account takeover.

Recommendations Update NetBox to version 4.7.0 or later. Restrict the "Can add custom links" permission to trusted users only.