CVE-2025-49143: Nautobot Information Disclosure Flaw

CVE-2025-49143 Overview

CVE-2025-49143 is an information disclosure vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform developed by Network to Code. Versions prior to v2.4.10 and v1.6.32 serve user-uploaded files from the MEDIA_ROOT directory through a URL endpoint that fails to enforce user authentication. Affected assets include DeviceType image attachments and images attached to Location, Device, or Rack objects. Anonymous users who know or can guess a valid file URL can retrieve these files without credentials. The issue is tracked under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve uploaded media files from Nautobot deployments, potentially exposing network topology diagrams, device photographs, and rack images that reveal infrastructure details.

Affected Products

Nautobot versions prior to v2.4.10
Nautobot Long Term Maintenance versions prior to v1.6.32
Network to Code Nautobot deployments serving user-uploaded media

Discovery Timeline

2025-06-10 - CVE-2025-49143 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49143

Vulnerability Analysis

Nautobot relies on Django's built-in django.views.static.serve view to expose files uploaded into the MEDIA_ROOT directory. This view does not apply Nautobot's authentication middleware or permission checks. Any HTTP client that can reach the Nautobot instance and construct a valid media URL retrieves the file content directly.

Because file paths for DeviceType images and object attachments follow predictable naming schemes based on model identifiers and upload filenames, an attacker can enumerate or guess paths. Returned content may include network diagrams, cabling photographs, and other operational imagery useful for reconnaissance against the target network. The vulnerability requires no authentication, no user interaction, and is exploitable over the network.

Root Cause

The media file URL route in nautobot/core/urls.py was wired directly to Django's serve view. This bypassed the authentication and authorization decorators applied to other Nautobot views. The fix replaces serve with a new MediaView that enforces Nautobot user authentication before returning file content.

Attack Vector

An unauthenticated remote attacker sends HTTP GET requests to media URLs under the Nautobot instance, for example paths beneath /media/devicetype-images/ or /media/image-attachments/. If the path resolves to an uploaded file, the server returns the file content directly without a login check. Attackers can pair this with directory enumeration or leaked filenames to systematically retrieve stored images.

python

# Patch: nautobot/core/urls.py (v2.4.10) — #6672
 from django.http import HttpResponse, HttpResponseNotFound
 from django.urls import include, path
 from django.views.generic import TemplateView
-from django.views.static import serve
 
 from nautobot.core.views import (
     AboutView,
     CustomGraphQLView,
     get_file_with_authorization,
     HomeView,
+    MediaView,
     NautobotMetricsView,
     NautobotMetricsViewAuth,
     RenderJinjaView,

Source: nautobot commit 9c892dc

python

# Patch: nautobot/core/urls.py (v1.6.32 LTM) — #6703
 from django.conf import settings
 from django.conf.urls import include, url
 from django.urls import path
-from django.views.static import serve
 
 from nautobot.core.views import (
     CustomGraphQLView,
     HomeView,
+    MediaView,
     StaticMediaFailureView,
     SearchView,
     nautobot_metrics_view,

Source: nautobot commit d99a53b

Detection Methods for CVE-2025-49143

Indicators of Compromise

Web server access logs showing unauthenticated GET requests to /media/ paths returning HTTP 200 responses
Requests to media URLs from IP addresses that never authenticated to Nautobot in the same session
Sequential or enumerated filename patterns under /media/devicetype-images/ and /media/image-attachments/
Requests to media endpoints where the Referer header does not correspond to an authenticated Nautobot page

Detection Strategies

Review reverse proxy or Nginx access logs for high-volume requests against /media/ with no preceding authentication cookies
Correlate media file requests with Nautobot session activity to identify anonymous retrieval
Alert on HTTP 200 responses to /media/* paths from source IPs that have never issued a /login/ POST

Monitoring Recommendations

Ingest Nautobot application and web server logs into a centralized logging or SIEM platform for correlation
Baseline normal /media/ request patterns per user session and flag deviations
Track the Nautobot version in asset inventories to identify hosts running builds prior to v2.4.10 or v1.6.32

How to Mitigate CVE-2025-49143

Immediate Actions Required

Upgrade Nautobot to v2.4.10 or later on the current release track
Upgrade Long Term Maintenance deployments to v1.6.32 or later
Audit the MEDIA_ROOT directory to inventory files that may have been exposed prior to patching
Rotate or remove any media that contains sensitive infrastructure detail if unauthenticated access cannot be excluded

Patch Information

The fix is delivered in Nautobot pull request #6672 for the 2.x branch and pull request #6703 for the 1.6 LTM branch. Both changes introduce a MediaView in nautobot.core.views that enforces user authentication before serving files from MEDIA_ROOT. See the GitHub Security Advisory GHSA-rh67-4c8j-hjjh for the full advisory.

Workarounds

Restrict network access to the Nautobot instance to authenticated VPN or internal networks until upgrade is possible
Configure the upstream reverse proxy to require authentication headers before proxying /media/ requests
Move sensitive uploaded content out of MEDIA_ROOT and serve it through an authenticated storage backend

bash

# Example Nginx rule to block anonymous access to /media/ until patched
location /media/ {
    if ($http_cookie !~* "sessionid=") {
        return 403;
    }
    proxy_pass http://nautobot_upstream;
}