Log in Start free

Vulnerability · Published Jun 10, 2025 · Assigned by GitHub_M

CVE-2025-49143Nautobot may allows uploaded media files to be accessible without authentication

Medium 6.3

In plain English

A medium-severity information exposure in nautobot from nautobot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.5%top 60.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file. Nautobot v2.4.10 and v1.6.32 address this issue by adding enforcement of Nautobot user authentication to this endpoint.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPInautobot1.6.32GHSA-rh67-4c8j-hjjh
PyPInautobot2.4.10GHSA-rh67-4c8j-hjjh
PyPInautobot1.6.32, 2.4.10PYSEC-2026-1689

Affected products (as reported)

VendorProductVersions
nautobot nautobot < 1.6.32>= 2.0.0, < 2.4.10

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References