Executive brief
Nautobot may allows uploaded media files to be accessible without authentication
Affected products
- PyPI nautobot
Junglewise Threat Intelligence
CVE-2025-49143: PYSEC-2026-1689 - Nautobot may allows uploaded media files to be accessible without authentication
CVE-2025-49143 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: nautobot (PyPI). Vendors: PyPI.
Related threats
- Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse cre
- PYSEC-2026-1688 - Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
- PYSEC-2026-1686 - nautobot has reflected Cross-site Scripting potential in all object list views
- PYSEC-2026-1687 - Unauthenticated views may expose information to anonymous users
- Nautobot unauthorized data modification in GitRepository API