Information Disclosure

nautobot is vulnerable to Information Disclosure. The vulnerability exists because the library uses django-db-file-storage by default, and it does not require any user authentication to access the database file storage. This allows an attacker to view files in the database storage and potentially perform arbitrary file downloads, as there is no URL mechanism provided for listing or traversing the available file names.