PT-2025-24686 · Nautobot · Nautobot

Glennmatthews · Published 2025-06-10 · Updated 2025-08-21 · CVE-2025-49143

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.10 Nautobot versions prior to 1.6.32

Description The issue concerns Nautobot, a Network Source of Truth and Network Automation Platform. Files uploaded by users to Nautobot's MEDIA ROOT directory can be retrieved by anonymous users who know or can guess the correct URL for a given file, due to a lack of user authentication enforcement on the URL endpoint serving these files.

Recommendations For versions prior to 2.4.10, update to version 2.4.10 or later to address the issue. For versions prior to 1.6.32, update to version 1.6.32 or later to address the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-49143

GHSA-RH67-4C8J-HJJH

Affected Products

Nautobot

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49143.json · Exploit
• https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95 · Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-rh67-4c8j-hjjh · Vendor Advisory
• https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340 · Patch
• https://github.com/nautobot/nautobot/pull/6672 · Patch
• https://github.com/nautobot/nautobot/pull/6703 · Patch
• https://osv.dev/vulnerability/CVE-2025-49143 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rh67-4c8j-hjjh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49143 · Security Note
• https://github.com/nautobot/nautobot · Note
• https://twitter.com/CVEnew/status/1932465943885607301 · Twitter Post
• https://t.me/cveNotify/133131 · Telegram Post