CVE-2025-49143 json
Nautobot may allows uploaded media files to be accessible without authentication
published last yr. modified 4mo ago also EUVD-2025-17712 , GHSA-rh67-4c8j-hjjh , PYSEC-2026-1689
- cvss
- 5.9
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file. Nautobot v2.4.10 and v1.6.32 address this issue by adding enforcement of Nautobot user authentication to this endpoint.
Patch / fix
- pypi nautobot 1.6.32, 2.4.10
- networktocode nautobot 1.6.32, 2.4.10
- github.com/nautobot/nautobot@9c892dc commit
- github.com/nautobot/nautobot@d99a53b commit
- github.com/nautobot/nautobot#6672 pull request
- github.com/nautobot/nautobot#6703 pull request
Is CVE-2025-49143 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nautobot | <1.6.32 >=2.0.0, <2.4.10 |
1.6.32 2.4.10 |
Affected products
- nautobot nautobot
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/nautobot/nautobot/pull/6672
web, patch
-
github.com
/nautobot/nautobot/pull/6703
web, patch
-
github.com
/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340
web, patch
-
github.com
/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95
web, patch
-
github.com
/nautobot/nautobot/security/advisories/GHSA-rh67-4c8j-hjjh
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-49143
advisory
-
github.com
/nautobot/nautobot
package
-
pypi.org
/project/nautobot
package
-
github.com
/advisories/GHSA-rh67-4c8j-hjjh
advisory
Sources
- CVE List CVE-2025-49143
- GitHub Advisory GHSA-rh67-4c8j-hjjh
- NVD CVE-2025-49143
- OSV PYSEC-2026-1689
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.