CVE-2025-69848

NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/alkimcoskun/CVE-2025-69848-security-advisories
https://github.com/netbox-community/netbox	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:netbox:netbox:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-03 18:16

Updated : 2026-08-18 13:17

NVD link : CVE-2025-69848

Mitre link : CVE-2025-69848

CVE.ORG link : CVE-2025-69848

JSON object : View

Products Affected

netbox

netbox

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-69848", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69848", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T14:49:30.716328Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-02-03T18:16:17.040", "references": [{"url": "https://github.com/alkimcoskun/CVE-2025-69848-security-advisories", "source": "cve@mitre.org"}, {"url": "https://github.com/netbox-community/netbox", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user."}, {"lang": "es", "value": "NetBox es una plataforma de modelado de recursos de infraestructura de c\u00f3digo abierto y gesti\u00f3n de direcciones IP. Una vulnerabilidad de cross-site scripting (XSS) reflejado existe en las versiones 2.11.0 hasta la 3.7.x en la l\u00f3gica de manejo de ProtectedError, donde los nombres de objetos se incluyen en los mensajes de error HTML sin el escape adecuado. Esto permite que el contenido controlado por el usuario se renderice en la interfaz web cuando una operaci\u00f3n de eliminaci\u00f3n falla debido a relaciones protegidas, lo que podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo arbitrario del lado del cliente en el contexto de un usuario privilegiado."}], "lastModified": "2026-08-18T13:17:19.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netbox:netbox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5EFC26A-92C3-402B-B2A2-1EB18B499A36", "versionEndIncluding": "3.7.8", "versionStartIncluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}