nautobot-device-resources (=1.0.0), nautobot-fsus (>=2.0.0 <=2.0.2) +2 more potentially affected by CVE-2025-49143 via nautobot (>=2.0.0 <=2.3.4)

nautobot PYPI version =2.0.0, =2.0.0, =2.0.0, =2.5.0 - nautobot-ssot-unifi =1.0.2 Source cves: CVE-2025-49143 Source advisory: OSV:GHSA-RH67-4C8J-HJJH...

nautobot-chatops (>=1.6.0 <=1.7.1), nautobot-chatops-arista-cloudvision (>=1.0.1 <=1.3.0) +7 more potentially affected by CVE-2025-49143 via nautobot (>=1.0.3 <=1.5.16)

nautobot PYPI version =1.0.3, =1.6.0, =1.0.1, =1.1.0, =0.9.2, =1.5.0, =0.9.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2025-49143 Source advisory: OSV:GHSA-RH67-4C8J-HJJH...

CVE-2025-49143

creationtimestamp| type| source ---|---|--- 2025-06-10 17:56:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrbhpiyk3l2e 2025-06-10 18:33:07+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17956...

nautobot-device-resources (=1.0.0), nautobot-fsus (>=2.0.0 <=2.0.2) +2 more potentially affected by CVE-2025-49143 via nautobot (>=2.0.0 <=2.3.4)

nautobot PYPI version =2.0.0, =2.0.0, =2.0.0, =2.5.0 - nautobot-ssot-unifi =1.0.2 Source cves: CVE-2025-49143 Source advisory: SNYK:PYTHON-NAUTOBOT-10337820...

CVE-2025-49143 Nautobot may allows uploaded media files to be accessible without authentication

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIAROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint...