Server-Side Template Injection in NetBox by NetBox Community

CVE-2026-104073

What is CVE-2026-104073?

A server-side template injection vulnerability exists in certain versions of NetBox that allows low-privileged users with 'Can add custom links' permission to exploit the Jinja2 template engine. By embedding JavaScript within custom link templates, attackers can access sensitive information such as session cookies and API tokens of other users. The vulnerability arises from the exposure of the raw Django HttpRequest object in the template context, facilitating an attack where user credentials are transmitted to an external, attacker-controlled server upon rendering the sanitized link in a privileged user’s browser. This flaw poses a serious risk of full account takeover and requires prompt remediation.

References