CVE-2025-49143: Nautobot may allows uploaded media files to be accessible without authentication
6.3
Basic Information
PythonTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nautobot | pip | < 1.6.32 | 1.6.32 |
| nautobot | pip | >= 2.0.0, < 2.4.10 | 2.4.10 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability allowed unauthenticated access to media files because the Django built-in serve function (django.views.static.serve) was directly exposed in the URL configuration (nautobot/core/urls.py) for the /media/ path. This function, by default, does not enforce application-level authentication. The patches (9c892dc300429948a4714f743c9c2879d8987340 for Nautobot 2.x and d99a53b065129cff3a0fa9abe7355a9ef1ad4c95 for Nautobot 1.6) address this by replacing the direct use of serve with a custom MediaView class. This new view, defined in nautobot/core/views/__init__.py, explicitly checks if a user is authenticated (request.user.is_authenticated) before serving most media files (with an exception for public branding files). Therefore, the django.views.static.serve function, as it was configured in nautobot/core/urls.py before the patch, is the vulnerable component that would be hit during exploitation when an unauthenticated user requests a protected media file. A runtime profiler would show django.views.static.serve being executed for these unauthenticated requests to the media endpoint prior to the patch being applied.