{"id":"CVE-2025-49143","published":"2025-06-10T15:43:59Z","modified":"2025-06-10T18:12:01Z","title":"Nautobot may allows uploaded media files to be accessible without authentication","vendor":"nautobot","product":"nautobot","tier":"tail","description":{"text":"Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file. Nautobot v2.4.10 and v1.6.32 address this issue by adding enforcement of Nautobot user authentication to this endpoint.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00438,"percentile":0.38095,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-rh67-4c8j-hjjh","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/nautobot/nautobot/pull/6672","tags":["x_refsource_MISC"]},{"url":"https://github.com/nautobot/nautobot/pull/6703","tags":["x_refsource_MISC"]},{"url":"https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340","tags":["x_refsource_MISC"]},{"url":"https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95","tags":["x_refsource_MISC"]}],"priority":{"score":12.0,"factors":[{"name":"EPSS percentile","points":7.62},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"nautobot","affectedVersions":[{"vendor":"nautobot","product":"nautobot","versions":["< 1.6.32",">= 2.0.0, < 2.4.10"]}],"affected":[{"ecosystem":"PyPI","package":"nautobot","vulnerableRanges":["<1.6.32",">=2.0.0, <2.4.10"],"patched":["1.6.32","2.4.10"],"from":["GHSA-rh67-4c8j-hjjh","PYSEC-2026-1689"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-17712","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-34707","published":"2024-05-13","fixed":"2.2.4","kev":false},{"cve":"CVE-2024-36112","published":"2024-05-28","fixed":"2.3.0b1","kev":false,"link":{"from":"CVE-2024-36112","to":"CVE-2025-49143","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:nautobot","fromFixed":"2.3.0b1","toFixed":"2.4.10","daysApart":378},{"kind":"version-step","provenance":"source","package":"PyPI:nautobot","fromFixed":"1.6.23","toFixed":"1.6.32","daysApart":378}]}},{"cve":"CVE-2025-49142","published":"2025-06-10","fixed":"2.4.10","kev":false},{"cve":"CVE-2025-49143","published":"2025-06-10","fixed":"2.4.10","kev":false},{"cve":"CVE-2026-34203","published":"2026-03-31","fixed":"3.0.10","kev":false},{"cve":"CVE-2026-44794","published":"2026-05-28","fixed":"3.1.2","kev":false},{"cve":"CVE-2026-44796","published":"2026-05-28","fixed":"3.1.2","kev":false}],"package":"PyPI:nautobot"}}