Is CVE-2025-69848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-69848 being exploited in the wild.

How severe is CVE-2025-69848?

Medium severity, with a CVSS score of 5.4, published 3 February 2026.

Which products and versions are affected?

NetBox Community NetBox 2.11.0 through 3.7.x.

Is there a fix for CVE-2025-69848?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-69848 attacked?

It is attacked over the network.

Am I affected by CVE-2025-69848?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-69848: NetBox reflected XSS in ProtectedError handling

CVE-2025-69848 · Severity: medium · CVSS 5.4 · Published 2026-02-03

NetBox is an open-source platform used to manage and track network infrastructure and IP addresses. When a user attempts to delete an object that has protected relationships, the system displays an error message. A vulnerability in this error handling allows attackers who can control object names to inject malicious code that executes in the browser of privileged users viewing the error, potentially leading to account hijacking or unauthorized actions within the platform.

Quick answers

Is CVE-2025-69848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-69848 being exploited in the wild.
How severe is CVE-2025-69848?: Medium severity, with a CVSS score of 5.4, published 3 February 2026.
Which products and versions are affected?: NetBox Community NetBox 2.11.0 through 3.7.x.
Is there a fix for CVE-2025-69848?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-69848 attacked?: It is attacked over the network.
Am I affected by CVE-2025-69848?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a reflected cross-site scripting (XSS) vulnerability in NetBox's ProtectedError exception handler (utilities/error_handlers.py). When a delete operation fails due to protected relationships, object display names are inserted into HTML error messages without proper HTML escaping, allowing user-controlled content to be rendered directly in the web interface. The vulnerability affects NetBox versions 2.11.0 through 3.7.x. An attacker with the ability to set or control object names can craft payloads that execute arbitrary JavaScript in the context of a privileged user's browser session, potentially enabling session hijacking, privilege escalation, or unauthorized administrative actions. This is a reflected XSS, so the payload must be triggered via a specific request (a failed delete operation), but no special authentication or privileges are necessarily required to create objects with malicious names.

Affected products

NetBox Community NetBox 2.11.0 through 3.7.x

Timeline

2026-02-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.